Extracted

• • Target
    adefd4d9465f11a06d133ed976175f1f900989fc1fe27e62d57c919c862aeb32
  • Size 45KB
  • SHA256 adefd4d9465f11a06d133ed976175f1f900989fc1fe27e62d57c919c862aeb32
  • MD5 3f1f96baae48c849ddce289d586ea0b4
  • SHA1 57aa44e5c16890607b0db4a91d2b476e188ad0fc
  • SHA512 7ae06e4e89e1c53807208548c35b4777c5979ffbd6fab5e29fcb9b438f7e89ec7af92f4387ea89242b917656259c9f0df2e267b4320a15129daa0acc3a7cd70e
  • SSDEEP 768:UuKWgSJTwU6NkWUGnaSmo2qA0wZQBKkPIZzjbwgX3igprFrrH/BXqG3VSBDZcx:UuKWgSJTwRf27bZ3b3XSgFFx69dcx
  • TLSH
    T107233B003BE9C137F2BE5FB85CF26145867AF6636603D94D2CC411DB5623BC6C6426E9
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2