Extracted

• • Target
    c2922babf76ac0b79f25e353dfef1b0e8b032d0edbf785ceec52e6639cd30f04
  • Size 45KB
  • SHA256 c2922babf76ac0b79f25e353dfef1b0e8b032d0edbf785ceec52e6639cd30f04
  • MD5 1385cff6e0bbbc30d368c200c406b778
  • SHA1 f50368d2812c0770baf85166fa4eb0da75ada0a4
  • SHA512 e6507c1e143eb80ef38bddda3770beeb42d82e65b88000e41222ab28fc845f356d44d12b18cafae2dcde64fee01d959baa299ae0f951de209fb262b44da73030
  • SSDEEP 768:5udApTNctooWUS7C+mo2qthRzMwnOPIZzjbcgX3i5ZVb0TWjbbS8IslBDZ0x:5udApTNmU2qA+3Z3bzXStjS8frd0x
  • TLSH
    T147232B003BE8813BF2BE4F78A9F25245867AF6673603D58E1CC4519B5613FC68A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2