Extracted

• • Target
    21ddc133325eda3e61568375ca7695d055b62f5a31d62fcef229df18bb97474a
  • Size 45KB
  • SHA256 21ddc133325eda3e61568375ca7695d055b62f5a31d62fcef229df18bb97474a
  • MD5 fcd96737a79eb51f620ea4865558821c
  • SHA1 cac219be30dbd98fe2ecd76acade1e2528b387cb
  • SHA512 17d36f07ad3bab2d6c41ebfc2c7d99535726976ba8a89c6bcf5dbe185ee8af513f6cea34fe6b0a9e9cca2196db9a45352772acb77e8a1e2b83b7ec26a0cdbf6f
  • SSDEEP 768:4uLZZTUAoOSWUYZL8mo2qFym/9GgROPIpzjb4gX3i376buZio1H4SQBDZbx:4uLZZTUTn2Zm1h3p3bvXSdZiwHidbx
  • TLSH
    T171231B003FE9812AF2BE4F789CF25245467AF2B37603D6491CC4529B5613FC69A42AFD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2