Extracted

• • Target
    21cee5e8c406c9c188dec3375be2d0a3cce42916af3a4c6db67162fcc7eccf2f
  • Size 45KB
  • SHA256 21cee5e8c406c9c188dec3375be2d0a3cce42916af3a4c6db67162fcc7eccf2f
  • MD5 0759102389376c4ff885a59217b1b31a
  • SHA1 6b3766c081e790edbf5f24fb041bbf229854c456
  • SHA512 adde6c561c707b8a7b3ac358c7faecefcdc89ffb6681a863bfb019b407da44a4ad76507e94bf87cb77679e6eac8f6590cf49556cf65e51daeda3c26e58345818
  • SSDEEP 768:EulCJTHESwgWUK3aGmo2q9ORzMwnOPIZzjbwgX3i59p4H4sV5PlBDZsx:EulCJTHl42PA+3Z3b3XS5o5Prdsx
  • TLSH
    T17F232B0037E8C12BF2BE4F7899F26145467AF2673A03D64E1CC451DB5613BC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2