Extracted

• • Target
    d23b22a45d4b40c6e1f10e086177cd549a680bb316c066e7fd7d74204c61802a
  • Size 45KB
  • SHA256 d23b22a45d4b40c6e1f10e086177cd549a680bb316c066e7fd7d74204c61802a
  • MD5 1a412668f6a2d8b10bbc3958317ddec9
  • SHA1 55098aee9b786133e85812eb068191b90181fd97
  • SHA512 e5b0d5162dab2c3ca3057ae33e23a85b4ea256ebf0c6ed85db27338de37abe2a35184f1b3030c19bf5d21a51cc5368201ff9aac283a0a1bc23f84b0d4d6f13ab
  • SSDEEP 768:cuR0JTPUYkEWUmjWymo2q1fLiE0yFjrdjYkk8PIuujbJgX3iaw/FKZWMTUXBDZUx:cuR0JTPjY2SLBXQBuCbGXSaKsZWWURdW
  • TLSH
    T190231A0037E9812BF2BE4F78A9F26245867BF5732603D64A1CC451DB1B23BC696426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2