Extracted

• • Target
    57c884ae4b0a7ed82ea4f860be7cdb720c5b6321a7afc72d3e37cab9f7dfd8c9
  • Size 45KB
  • SHA256 57c884ae4b0a7ed82ea4f860be7cdb720c5b6321a7afc72d3e37cab9f7dfd8c9
  • MD5 ac6f2b0710c1484abc0f9314051b07eb
  • SHA1 92d998195da7bbccecccac0f7c114238ff401d57
  • SHA512 cdfdc8677fd1cd64e0254a7b28eb763e8efe376b54feadd59fdd669cbd45a7d26032b344f72b4f3adbaca8353270534067d3b15e64c4525b74e03fadd9a6f60b
  • SSDEEP 768:0u2vpTD4U2ieWUsqfAmo2qjQcQSCBznqNLPI7zjbmgX3i/uTsZpD/kbGJvN2pBD4:0u2vpTDe+2nc9UqC73b5XSmTwpYbGa3M
  • TLSH
    T10E233A003BE8812BF2BE5F78A8F25145867AF6633603E5492CC451DB5713FC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2