Extracted

• • Target
    2373f0df19bbc4a273c85883c40024a948898e2f41a8b33de015f982920afa20
  • Size 45KB
  • SHA256 2373f0df19bbc4a273c85883c40024a948898e2f41a8b33de015f982920afa20
  • MD5 f386d10c5438b18bee69b90eeeba288c
  • SHA1 6b1f04f05a1f956a7e42352c2445490d3fd49cd7
  • SHA512 921769be79df58b3b6ac41e6991a948b1449ec1370a3d2202aad918f9d14fdfae4c9036aa99ddaef6f434f0cb5ad5405732193a887b3b7d5ec863974171583b6
  • SSDEEP 768:EufspTfzcR6uWUcb+wmo2q9L9YSkqXzNOPISzjbKgEW3ix0MIwrvcgRmOBDZsx:EufspTf2g2maVq3S3bdEWSxZcgrdsx
  • TLSH
    T16B232A0037E9C22BF2BE5F789DF26145467AB2633603D64A1CC412D75623FC68A526FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2