Extracted

• • Target
    25183ac3c063c4c0966fcf2b985993b04b767bd786fbdba9d167d87a5f2df1f1
  • Size 45KB
  • SHA256 25183ac3c063c4c0966fcf2b985993b04b767bd786fbdba9d167d87a5f2df1f1
  • MD5 4541164f1db1eb6984b34904f364c5e3
  • SHA1 af7a0fabdde348275c6c51eccf76c3af5ee19c00
  • SHA512 e7060ae661fd8b00950ddfb60bfac244d8e54cb6fe5e6d8953acde220faac329a79e410c92b57b57ad4fb731ed5c33c89f3469431299e119cb28efec4101ec40
  • SSDEEP 768:EufspTfzcR6uWUcb+wmo2q9oozfy3CKPIt2jbhgX3ilSWG1I+BtxGfgFBDZsx:EufspTf2g20TRt6bOXSl7G2+BjSudsx
  • TLSH
    T131232A0037E8C12BF2BE5F78ADF26145467AB6733A03D6491CC4119B5723FC68A526FA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2