Extracted

• • Target
    c21ccf20aeb39a424885ebb29072f785de22ddde562c0b2b3cb55461ad25efd5
  • Size 45KB
  • SHA256 c21ccf20aeb39a424885ebb29072f785de22ddde562c0b2b3cb55461ad25efd5
  • MD5 c83f590304429399dca24b1e29ef5f4e
  • SHA1 c1924bf5784f1b3530d8945e40407213bbf92f6d
  • SHA512 749ba048a16c8dd9750e43e1eee26a87965ec507a582d5edb99214cf32e4b04ba790c578c16a9f069bd15240e729d670269a33d6465064aff6fca1dc34c3de33
  • SSDEEP 768:4uLZZTUAoOSWUYZL8mo2qFjlsHoPEaMPIGNjb6gX3iyzIFpKTQz+FBDZbx:4uLZZTUTn22uuEaxGFbtXSyGpaLdbx
  • TLSH
    T119231A003BD8822BF2BE4F789DF26145497AF2772603D64D1CC452DB5713BC69A42AFA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2