Extracted

• • Target
    0d322e2694807aa76868a624b49ed750f62909e086049cd90cc4d756c8769c78
  • Size 45KB
  • SHA256 0d322e2694807aa76868a624b49ed750f62909e086049cd90cc4d756c8769c78
  • MD5 5ffbbd94d358eabd78185860f017f5d2
  • SHA1 048ef12692ec672d70e5c9e1ee27f10ad27316b5
  • SHA512 ec5739cf244677cd38baa1d9eae5f06a5c2df61b860a325c8457c55c0475928253f0b90ffaf0b97dd00d573d9387cfc1f140ccdf0cb2653aac8b1fb4a6921640
  • SSDEEP 768:0u1YJTHwAUgQWUaT2Wmo2q9mdR3aI6OPIuzjbegB3iyeJejWppxfBDZ8x:0u1YJTHcw2Zjqb3u3bhBSdyWpxd8x
  • TLSH
    T1D9232C0037E8C22BF2BE5FB4ADF26145867AE2673603D58A1CC441DB5613FC69A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2