Extracted

• • Target
    072cfea22e3f11f3c1e6b0fd4aabab4e669a0db178d8529e49fde04d8c370fb1
  • Size 45KB
  • SHA256 072cfea22e3f11f3c1e6b0fd4aabab4e669a0db178d8529e49fde04d8c370fb1
  • MD5 fb1a9a242deddcddb0c61ea917aadcb9
  • SHA1 63a8d5643b0067a96d2a8e0485d7bf735187830e
  • SHA512 89755fb06780ff7de175e59215beebeb15fa8a5cd50b99137f261ea0ef61eca0761f86058ef680ce7a386b124e2c7ef2e8dfd92b276a807aaa1f139a45e59d62
  • SSDEEP 768:cuR0JTPUYkEWUmjWymo2q1wpt0CCMhdjCvS8PIj4jbbgX3igu8ehm+5yN03EuBDg:cuR0JTPjY2p/CChBjwbkXSgu5B52SdUx
  • TLSH
    T168231A003BE9812BF6BE4B7859F22145867AF6732603D6491CC441DB5B13BC69A43AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2