Extracted

• • Target
    abc3d280517a2598a1ddb9cfba5478d015ff146f96a9c552d4bdb2b691122272
  • Size 45KB
  • SHA256 abc3d280517a2598a1ddb9cfba5478d015ff146f96a9c552d4bdb2b691122272
  • MD5 ad0d6ed7dbac2ae0adaadc9a9046bf4a
  • SHA1 dbdc74c3dcd274eca06607b38b057f115cdd359c
  • SHA512 13bb40d26824f7810b54b9ada3256884047c8593135071ee26c09dd0c36bfff0a54343cbb49a9a865ed79e7978b3e1d4cc580e24a0d94155c7c692086bdc9d69
  • SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFOeeXK5o5TN8/nPI6EzjbqgX3i5C8MNT/5XbWoBDZEx:MuLAZTnbg2aeEoTNKA6E3b9XS5C8MNTg
  • TLSH
    T108232B003BE8812BF2BE4F78A9F261458A7AF5732603D55E1CC452D75713FC68A426ED
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2