Extracted

• • Target
    d95127743a382a646ba6ffe18032ec6c0ecdc234ed80f5863745c1ceab71bd7c
  • Size 45KB
  • SHA256 d95127743a382a646ba6ffe18032ec6c0ecdc234ed80f5863745c1ceab71bd7c
  • MD5 62c1eeb79b7aa10f81fa44cea314c043
  • SHA1 02e0a9636e2ec2cbb61b5209fd65c6a616859420
  • SHA512 b79ec2322bc19331950dc9e9a55e5021749fd41a3563476a2ae8d0177e980d6bdbad60651701c4a8e8c5e366cd4df942814f68aefdaac5c8a69e7c57dfabf7b6
  • SSDEEP 768:cu6RaepTPYzbs8WU+Xaamo2q13oCa/ld3APIXzjbwgX3MXlL7D83UDdjbBDZUx:cu6YepTPso2OE/T3lX3b3X8VLvUydRdW
  • TLSH
    T1CD232A003BE9813BF2BF4F7899F26145867AF2636603D6891CC451DB4623FC69A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2