Extracted

• • Target
    cd3773400d07bcefb2bb4adfaff7bb334ef6eaef54e58c816690edaabf324342
  • Size 45KB
  • SHA256 cd3773400d07bcefb2bb4adfaff7bb334ef6eaef54e58c816690edaabf324342
  • MD5 29d0531294d6bb77843fe16422d750bc
  • SHA1 1c7c9a1069b54eaff99df5bc42e5b895d84a6b04
  • SHA512 b786f4eae864bfb5d61bafb79f70f9ac64abc4fa4e7fb7afa2a3d727b2b6f55a4cc1a6610d64ae8523d08cac3c5e022a27c47e3cd52668643528bd1127ef1426
  • SSDEEP 768:EufspTfzcR6uWUcb+wmo2q98zjHynaKPIswjbrgX3iaGkfWcnaky1N3QZ2BDZsx:EufspTf2g23nZs4bUXSeut1Njdsx
  • TLSH
    T1D1231A003BE9C12BF2BE4F789DF26145457AB6632A03D68D1CC4119B5723FC68A526FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2