Extracted

• • Target
    db42163ef985288a3caa4a42d1e45a0c645ad811d446a908e3484034f08c94c3
  • Size 45KB
  • SHA256 db42163ef985288a3caa4a42d1e45a0c645ad811d446a908e3484034f08c94c3
  • MD5 1951776a91054803d17cbaca1aab6b6d
  • SHA1 b1671ae3a4326219374bf88d06935e95c4c7542c
  • SHA512 d0b022ea70fed6587fd158ec2994c5cab90b37e33eaf91162016bef84d746d072049515aea4d3dc6a2536a504d0785e1e43946d4743fdd392bf6d31b5d8d13db
  • SSDEEP 768:cuqb5TrIGuCWUoKXMmo2qQXm/9GgROPI2zjbQgX3iHobWxS+FiBXjJPBDZUx:cuqb5TrhG2Dm1h323bXXSHXxSDTjdUx
  • TLSH
    T1A0232B003BE9C127F2BE4F7899F26145867AF6A32603D5491CC452DB4B13FC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2