Extracted

• • Target
    df63806835951ef97da7016c8fefde972c8f6b6462f00f00a52ac0ba64572d7a
  • Size 45KB
  • SHA256 df63806835951ef97da7016c8fefde972c8f6b6462f00f00a52ac0ba64572d7a
  • MD5 dbc5a36f0857a489c5d64f327d2674ef
  • SHA1 1dfb5520664ec80c69cc249629aca7fe3ac8face
  • SHA512 7f3c3963d5e0d02b729d28798b923ad9fc5f28e4036a6b512b49a6004acafeb241ac5c1edec13a7b75319e3d78604677d6811f52c2483c9d140dd37a67a76d30
  • SSDEEP 768:cu7m/5THrq+CWUoDuMmo2qFCzdAAyPMlL8TfPIMWzjb3gX3r2x1BPH54PNRBDZUx:cu7e5TH2A2nlvlL+4MW3bQX72xLh4Fv0
  • TLSH
    T127232C003BE8812BF2BE4F7899F26145467AF6737603D54A2CC452DB5613BC6C642AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2