Extracted

• • Target
    d3a965d806a67a56ead0d8617f091b4409dde1ed506f2e67410b7f5f40df3eae
  • Size 45KB
  • SHA256 d3a965d806a67a56ead0d8617f091b4409dde1ed506f2e67410b7f5f40df3eae
  • MD5 2c693594852d210f8a8c3277c9a662e8
  • SHA1 b6536aa2b2ea808f5cdca445e8242470d8dc4ab1
  • SHA512 5bf633222280f4cf594fc0012bd8985c60b1e8914d2eca269cefb4a33d3f7594c4639de38211c180bf117db621a35f8422513bac0c080d6b0baf95dd2fe80b88
  • SSDEEP 768:RuxkJTVmU5EkWUGMKSmo2q11Bz3QKx7PIUQjbDgX3iSmUJQxhQVG1F5BDZcx:RuxkJTgip2AV0UYbcXS8JQxhQYrdcx
  • TLSH
    T115232A003BE9813BF2BE4FB8ACF26145867AF6637603D5492CC451DB5623FC696026F9
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2