Extracted

• • Target
    ca2d0600da55b527383b4fe13bc4428cc15a1e54786c4670fcd2b9e9cd1ed266
  • Size 45KB
  • SHA256 ca2d0600da55b527383b4fe13bc4428cc15a1e54786c4670fcd2b9e9cd1ed266
  • MD5 88adff19a4d12a5faf067019ff8a4001
  • SHA1 6ecbca135dcf2d9c543654e2ccf9e9a05b56b116
  • SHA512 b9cdaca1e8ce7dce21c20c71a030edb527e94f64435616d7b190bd7be594bb9f567f9df96a1d2b2a7580d8d42e0ac00adb56d5638a6ac6371c5e90ac709de98b
  • SSDEEP 768:UuKWgSJTwU6NkWUGnaSmo2qAbgzZUpx7PI8fjbcgX3icWfsmqBDZcx:UuKWgSJTwRf2ron8rbzXScWEldcx
  • TLSH
    T171231B003BD8823BF2BE4FB868F26145867AF5637503D5896CC4529B5623FC6CA426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2