Extracted

• • Target
    414dc3412b05172a659c27e24161fe59533f5acc8217deba7788afab551e5d5a
  • Size 45KB
  • SHA256 414dc3412b05172a659c27e24161fe59533f5acc8217deba7788afab551e5d5a
  • MD5 ea34795d34b545655e7ad1381327be84
  • SHA1 68a22a48a7e375e3136a66b596ab9e8764be76c1
  • SHA512 f83f18471e370cadaae6b54470d0d2177ba93a03f5e32294f1dc740f531db142443f60abcbd77222b1ee7d8309a37b18c61f19e0216e2da20269c61a645a9343
  • SSDEEP 768:0u2vpTD4U2ieWUsqfAmo2qjMITnyfaaPItzjbsgX3iKzM3eEJNzKUnQ8dOBDZ8x:0u2vpTDe+2FEht3bjXSKzM/RrQ8dAd8x
  • TLSH
    T193233B003BE9C127F2BE5F789DF26141867AF6632A03D64D1CC4119B5613FC68A526FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2