Extracted

• • Target
    24e7174303c9dbe12819d2534975aba027ec445b5a4a19ac4a3c6516c9a908db
  • Size 45KB
  • SHA256 24e7174303c9dbe12819d2534975aba027ec445b5a4a19ac4a3c6516c9a908db
  • MD5 e392c3f1dc388ca24046ea90b9165b35
  • SHA1 5cf62b70c9bff326e127c2b44a23cb73bfe0b56a
  • SHA512 15eb4f0162158494535d41b9252373a43a8bf66d75c77f13de7d5afbe670fec2e75a3150bda77e4588ee57b32275b270a42dcb4053a510d3fd421567e398a448
  • SSDEEP 768:EufspTfzcR6uWUcb+wmo2q98ITnyfaaPIDzjbagX3itCWXbRP8XilZBDZsx:EufspTf2g23EhD3bNXStCubRUyxdsx
  • TLSH
    T1AD232A003BE8C12BF2BE5F78A9F26145457AF6632A03D6491CC411DB5723FC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2