Extracted

• • Target
    dda9e00d90f7a2b1641b9e533dac7287a919636e7d0e2b2386a03cdfbc642205
  • Size 45KB
  • SHA256 dda9e00d90f7a2b1641b9e533dac7287a919636e7d0e2b2386a03cdfbc642205
  • MD5 15908688390bee16a81411f479325cc9
  • SHA1 cebd8c5db7df9846ee049c0f96fc6e8515972437
  • SHA512 ee7c3d64ecbdfcc7ecc8b5adc2839c55ba92e9b540c5385a359f73020864c158af29598e45d85372cc80ec94f2df9758978a765a3f105807fe2b0a320125d0a9
  • SSDEEP 768:wuZ8pT1Uu4/cWUeT66mo2q1V8V1RpPEcPIMzjb1gX3iti5WTatUflttGLRBDZMx:wuZ8pT1tc2W8VDZEhM3bSXSooaUYbdMx
  • TLSH
    T1B3232B0037E9822BF2BE4F789CF26145467AF6632603D54D1CC441DB5623FC69A92AFD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2