Extracted

• • Target
    dca70bf0a9ec01884f4c4c55d404d7dce190edbe27aca4d52139e4ecdb12b84c
  • Size 45KB
  • SHA256 dca70bf0a9ec01884f4c4c55d404d7dce190edbe27aca4d52139e4ecdb12b84c
  • MD5 87d104ed16dc30c6c0cf8ce2882e0465
  • SHA1 667f6ca27d518b8e8bee9b287dec6cbb1859e236
  • SHA512 4acc46176ffd0e46dc12536d6167f3de8b50ea5fb19f2de1b90b39e2e12f617777792450c2e59d70a699e742e56362fbb3520a8046984dbbe99e59ab8fd2ba5c
  • SSDEEP 768:0uAVhJTDEQAQWUaDyzWmo2q7h/cYssPJZOPIcvzjbzgXIikK34SPVud9+ksdvBD4:0ushJTDXgH20MIf3cv3bsXFkZScPKZd+
  • TLSH
    T102232C003BE9C22BF2BE5F7898F26145467EB6633603E58D1CC4519B4613FC69A42AFD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2