Extracted

• • Target
    217a56dc57058ec2920266b828ffb7ef0c6f54bbabc363cb357ad3f4f1a567ae
  • Size 45KB
  • SHA256 217a56dc57058ec2920266b828ffb7ef0c6f54bbabc363cb357ad3f4f1a567ae
  • MD5 40a33e4eaedaf96f9823d92ea711f56e
  • SHA1 a3591771b7410b6a037b492f04c5104b7a467389
  • SHA512 b0b61118c170e1c7f72cae05a7eb2a4fa085e0a3481a04258a6deab1a1404552ad8676c3a35a7bb1fd7097509b698e2bbfb7ba00d11faf9125b48e359718c33b
  • SSDEEP 768:ku40ZTX3uXTaWUgzW0mo2qwqlsHoPEaMPIGCjb7gX3iZFS1QguxtHX7wu0BDZMx:ku40ZTXEb2euuEaxGObEXSZ9xtLsdMx
  • TLSH
    T1D6232A003BE8C16BF2BE4F7899F26145467AF6737603D58A1CC441DB4713BC69A426FA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2