Extracted

• • Target
    0d3045906e5fec22fd225cf832b3e5d891d80205036831c8ebad9860928e8ea2
  • Size 45KB
  • SHA256 0d3045906e5fec22fd225cf832b3e5d891d80205036831c8ebad9860928e8ea2
  • MD5 6c04df4e0a4e5c0655c7b28dd24999c7
  • SHA1 f52a30d41930a6556c1a93f93d4323258cef1147
  • SHA512 0e0ba0309832ae4840851ff3e1e1a32cf06bb99fc24a42aecf87e1909a57afb18d339af7dc3377247f8495276a8bfde6357d4161b1ed085e050d44fda1b278fb
  • SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFEfBohEa+PIvgjb1gX3iCMkDHqsT3IysDC8BDZEx:MuLAZTnbg2Z4EaHvIbSXSCMkbBT4ysDg
  • TLSH
    T1CF232B003BE8822BF2BE4F78ADF26145867AF5637603D6491CC411975713FC69A42AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2