Extracted

• • Target
    d59c669bd911a424889c76384c53b7aa02df67edbb6013bacc7b9102035a5422
  • Size 45KB
  • SHA256 d59c669bd911a424889c76384c53b7aa02df67edbb6013bacc7b9102035a5422
  • MD5 2a46c589d155314eb4bc207a52cfb433
  • SHA1 434dab4b19faddb1e55b40f7b1fc0ee22e00afcd
  • SHA512 a4fc0d5b93cf0504fd5731a578a3813726e8db7ae7d270385cb9918c9b2142f1eabea43dfb1785d16b4e1302a26cc8f8abc15c3f23c3ee8ba950074c285e3246
  • SSDEEP 768:8uuSpTg7GBoWUSH6+mo2qYJCHyTtpPIhzjb8gX3icisdLPAQvU9BDZ0x:8uuSpTgyf2RnQh3bTXScndL4QvOd0x
  • TLSH
    T16623F90037E8812BF2BE5F78A9F26145867AF6733603D58D1CC441DA5623FC59A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2