Extracted

• • Target
    c27e21813866c0908fe8d9a01ec8620cd8efecf98df917984fae843c4b7caefc
  • Size 45KB
  • SHA256 c27e21813866c0908fe8d9a01ec8620cd8efecf98df917984fae843c4b7caefc
  • MD5 7109c32f80e96e7a70916fbb81b33fc3
  • SHA1 3a3bc475347bfca9313883ca59add087407fd1ff
  • SHA512 e80066133de9d7fe4aacad9998b32742410af5676bca71d912a191b4881e70b70c230425f44835b2d09a36838f6a4894fdb599596d91264f3ab53a114706a35f
  • SSDEEP 768:suJdpTP3tcsWUODmqmo2qV2maPcl83APITpzjbhgX3i1NyGNrcm0yDNqBDZkx:suJdpTPdI2HfcS3lTp3bOXS1gGEyDedm
  • TLSH
    T1642319003BE8813BF2BE4B789DF26141467AF6636603D65E1CC451DB4623FC69A42AFD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2