Extracted

• • Target
    d55999debe283ac129cb7ffc47f755c31a466cefad8a8468f4f4d90ac698110a
  • Size 45KB
  • SHA256 d55999debe283ac129cb7ffc47f755c31a466cefad8a8468f4f4d90ac698110a
  • MD5 f375908279e272869330995c55067161
  • SHA1 ba68b826905a553aea9bf94e64316b683dd16a55
  • SHA512 be1c7ff64086698f70324cb82f587041875cf379ef61d657dfd81006c98d4872c2e32203d97fd95d42044a138146c7dfb94603281ddbae767fcce7399059fa30
  • SSDEEP 768:wuZ8pT1Uu4/cWUeT66mo2q1a0e3NEARViZPIrzjbmgF3iE/Hkql2dyQUTM+gVBDo:wuZ8pT1tc2t3e+iWr3b5FSO5QIQdMx
  • TLSH
    T115231A003BE8812BF2BE4F7899F26245867BF6676603D5491CC451DB4623FC6CA43AED
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2