Extracted

• • Target
    d3fe105929ea8b58ca43252ba94a292b26a95860e22f92a15d4c6dc9194de538
  • Size 45KB
  • SHA256 d3fe105929ea8b58ca43252ba94a292b26a95860e22f92a15d4c6dc9194de538
  • MD5 20172c8a5c4b669d420346464f1ebd01
  • SHA1 96fe3383a3b69e25e6a38ef29aadad3aa760ba9a
  • SHA512 9ed5bf1cccde8b3fbff5e9af73e0ce22075b87718c05f85b9df00b5f423b67f51394a65bb3296a1dbb71f11446131fe39cd2429a339f6a03f81787f38f13d3c4
  • SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFOeeXK5o5TN8/nPI6EzjbIgX3icuOgOo3dgLbwBDZEx:MuLAZTnbg2aeEoTNKA6E3bfXScuOgRct
  • TLSH
    T1C7231A003BEC812BF2BE4F78A9F26145867AF6632603D59A2CC451DB5713FC686426ED
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2