Extracted

• • Target
    932121d2b2c6767609d637fc0f85e9e5561dc4e2cb0f77909b7d174c060b4987
  • Size 45KB
  • SHA256 932121d2b2c6767609d637fc0f85e9e5561dc4e2cb0f77909b7d174c060b4987
  • MD5 5bd53d778f47c0af26662086dc968ae6
  • SHA1 853da62a569b9855a86f3cc8a709c542600992dc
  • SHA512 529835577bcff9d6087fe07002d42482a7d3fa1b709fcd065928c93d26759ac867f3da3f5de9c29143a84e7ae452351c23200fbcface79d43028ca5108a3e202
  • SSDEEP 768:QulLJTEs+EgWUKJTGmo2q98COtTMtPIdzjbTgX3isDUeOoIrEBDZTx:QulLJTE9X2jRvd3bMXSsROrydTx
  • TLSH
    T1E3232B003BE8812BF2BE4B7899F26145857AF6677703D58E1CC441DB1723BC69A42AFD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2