Extracted

• • Target
    24618ad7c4aee7ed2e69a153291031abced8e65189e2454a4442a326275422c6
  • Size 45KB
  • SHA256 24618ad7c4aee7ed2e69a153291031abced8e65189e2454a4442a326275422c6
  • MD5 c011490b6bc51a4b41b9630063b63e0e
  • SHA1 b84e79dcf434f51f3b895c7f62b2819d7247ce83
  • SHA512 a23deeaadb014d1d48594b53eafb26ac8ab732c94312582c1e5b08693472e0e2445920ee79d45e179b2346636a45ddbbef3ae566804729c879f82c9e2422e424
  • SSDEEP 768:kuSOpTPTCFcWUeXa6mo2qA8/q0CCMOd4Cpb8PIDRjb2gX3isiqx3ZqLInBDZMx:kuSOpTPOP2M4CtVBDBbpXS7qhZ7dMx
  • TLSH
    T1BB232B0037E9812BF1BE4F74A9F25145867AF6732A03D54A1CC451DB5A23FC68A436EE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2