Extracted

• • Target
    442ff2698eada07ea418c2a55bd617a6eeaa624d0507652ff547a541ec218487
  • Size 45KB
  • SHA256 442ff2698eada07ea418c2a55bd617a6eeaa624d0507652ff547a541ec218487
  • MD5 ecdd7a54df48ea27637e58e97a17760d
  • SHA1 a222c1dbd60b35d30b03f23726620262b1c9ffd9
  • SHA512 7e4efafd1c793e3de7e3fc65291dad7eb2978affbc7addfa1165a925b5f7e0038fa14ca99b22c156f654b36b5ef45a43ce84111569fafdaa8a7379fddcf95845
  • SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFB3XodEayPIdzjbigX3iUaP9zmOIkiBDZEx:MuLAZTnbg2uUEabd3bFXSZ5RI7dEx
  • TLSH
    T1E1233C003BE8816BF2BE4F78ACF26145867AF5A37603D5492CC441DB5613FC69B426F9
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2