Extracted

• • Target
    d24fbd0b7fccf6c06d669def57e413e464496981051a95387bc390494ff96088
  • Size 45KB
  • SHA256 d24fbd0b7fccf6c06d669def57e413e464496981051a95387bc390494ff96088
  • MD5 e2c74cacfa0e37e55b52cf63655ad2fe
  • SHA1 2016f5388ddf1246b17bdd9ac2af4d7aa7d72646
  • SHA512 988fe32dfc40779314c8558782988e2b7c838fb9f178f8f0142f385228a23788e91393ccb84a7578a5b38c654e1ebb8a88218494540a0172f95b79481d128751
  • SSDEEP 768:cu7m/5THrq+CWUoDuMmo2qFP9xY6aZOOPIrzjbFga3icpsyFG+dHFB3B8BDZUx:cu7e5TH2A26s/O3r3bCaScdFTYdUx
  • TLSH
    T12E232A003BE8822BF2BE4F789DF26145467AF6A33503D6891CC451DB5613FC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2