Extracted

• • Target
    29b6791b95bf3fbdb8343d8ba0642eca061e5fbf56536777f6e8a82933a4ee64
  • Size 45KB
  • SHA256 29b6791b95bf3fbdb8343d8ba0642eca061e5fbf56536777f6e8a82933a4ee64
  • MD5 9830e0d6ff9fc38b0e8f0145bbdd42b6
  • SHA1 8d17c9da7fcce1942598de1d6efae7fd4dd9dd79
  • SHA512 2be7ccb8bd6c7737c86bdda2864218d98150bb5b82f3f6aa5e04e9e0340648d510fecbe59e928b2eda3c08fd44720c8f781efea66681c05de1cebe9d28ccf843
  • SSDEEP 768:ku40ZTX3uXTaWUgzW0mo2qwP3Fo9EaOPIozjb5gX3i1soXgbIeu1VtBDZMx:ku40ZTXEb258Ea3o3bWXSGbaHdMx
  • TLSH
    T1FA2329003BE8826BF17E4F78ADF26145867EB6632603D58A1CC441DB5713FC69A426FA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2