Extracted

• • Target
    23ca24f501f786ccefe5d92b4bfc5f2b4fbeea0e123e353373250566a56c2ac7
  • Size 45KB
  • SHA256 23ca24f501f786ccefe5d92b4bfc5f2b4fbeea0e123e353373250566a56c2ac7
  • MD5 f63a0e88252a77644a91ca032c41b9e0
  • SHA1 10204b0535456aea1878a53c6115fbe3c5ac9ed3
  • SHA512 147633b2543aa817c7a46d6423f07b1fb459cb064385aa81efb430d814761e613c1fcc0e636dc6248ffa77ab08a352ee18337d95cebe59f1000baa5177bfc2ec
  • SSDEEP 768:cuR0JTPUYkEWUmjWymo2q1Z0ewtSc30oiZPI3zjbOgX3izuqlmH4HQVko4a1Ym4N:cuR0JTPjY2Aww2iW33bxXS+YHyYm4FM0
  • TLSH
    T1FE231B003BE8812BF27E4F78A9F26145867AF6636603D5491CC451DB5713FC686436FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2