Extracted

• • Target
    21e3756e522f30501c0af191fc94eeb3eb12fff3b4cc9c4f4bdef75b1f9f91e9
  • Size 45KB
  • SHA256 21e3756e522f30501c0af191fc94eeb3eb12fff3b4cc9c4f4bdef75b1f9f91e9
  • MD5 5c538c9b6fab667cf8f2523db467c159
  • SHA1 2a1b1322556c351c4b377346af0799bc5fcdabb9
  • SHA512 0c09e57e33490665a9b9d7137a76792fd6313ad92ab7ea2b731c6e7008a37867f75afc7b9925eca4f4bcdf19cbbd5e180664847cd754e00bcdd03cbaf3479397
  • SSDEEP 768:FuxkJTVmU5EkWUGMKSmo2q1v0UwPOlehAPITpzjblgX3iF6m3vJB/8GBDZwx:FuxkJTgip2G0/OghlTp3biXSXvPkIdwx
  • TLSH
    T11D232B003BE8812BF6BF4F789DF26105467AF6637603D64A1CC452DB5723BC68A426F9
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2