Extracted

• • Target
    d2facba1fdb81811f8cd32dbbf32ed88b68df2088b059aefd64d0f6a1f1884bf
  • Size 45KB
  • SHA256 d2facba1fdb81811f8cd32dbbf32ed88b68df2088b059aefd64d0f6a1f1884bf
  • MD5 248990a5a912ea49c4380dee31f3d3da
  • SHA1 f3b52ef64e3c9ff298bc868cdac9414d3799b9f9
  • SHA512 bfc264ea7d4c874b1fd8d227f0da4191b76124dbf8e1e4f599443c6b70d48b7b1e024d1e08c2211aa68e0ce7954418958bf5396ebe1a9bff82ec99e883e8c395
  • SSDEEP 768:8uUIpT4vvofWWUEXb+Imo2q4GoopCBK9INJPIZzjbUgX3iPvqHvHhyDDP4gGGPBU:8uUIpT4vAj26o6bIwZ3b7XSPvqpy3AOu
  • TLSH
    T17C231A0037E8822BF2BF4B7898F25145867AF6633603E54E1CC451DB5623FC69642AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2