Extracted

• • Target
    2229c994d99bd13e9ac247489432d5ec753ebff820772074639450791cb6daa6
  • Size 45KB
  • SHA256 2229c994d99bd13e9ac247489432d5ec753ebff820772074639450791cb6daa6
  • MD5 c70006910ca6ba7882a2d0fc2dba96d6
  • SHA1 4e95a62324d060a9fdd0c52ad7406e52c3b6c38b
  • SHA512 709fd3316550b880e63d5be42fafa175d0334f83ed1c310284ceeb927a5b6eef8ef93a29520db409bbd995d6adc2394f155c14a24fed4c396d5c8e10d71ae06b
  • SSDEEP 768:4uBfJTMUyYUWUWBDimo2qVgpt0CCM+d4CvS8PIk6jb1gX3ipKTjU87K9TcyBDZbx:4uBfJTMpv25/CFWBkWbSXS0vU8GhcMdV
  • TLSH
    T191231A003BE9812BF2BF4F7859F26245867AF6632603D54E1C8451DB5723FC68A436EE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2