Extracted

• • Target
    d23420798aebafaffe59a499dd50781f619fc4ede7665ee95b002c0d372bbba0
  • Size 45KB
  • SHA256 d23420798aebafaffe59a499dd50781f619fc4ede7665ee95b002c0d372bbba0
  • MD5 e03b2d8c2934fce35b4a4cdfb26dadc2
  • SHA1 4a96b863da07e0f5ff278b1db4f9d0eb94adfed0
  • SHA512 351b918b5fc5ce86ff1566c04e9640575e8410a112de4b52da28552a831a6824db0072cbdb75efbf58782c81a291b590db9c72346857acd243da3a0b3507e008
  • SSDEEP 768:UuKWgSJTwU6NkWUGnaSmo2qAjb3/GYjHuPInzjbUgXziDSgJmExcu7BDZcx:UuKWgSJTwRf2TL/3n3b7XumMmOcutdcx
  • TLSH
    T1F1232B0037E8822BF2BE4FB898F26145867AF5637603D68D1CC451DB5623FC69A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2