Extracted

• • Target
    1007c968d509802427f315bee3708860077a2711799cb79de01d6186782f3fd4
  • Size 45KB
  • SHA256 1007c968d509802427f315bee3708860077a2711799cb79de01d6186782f3fd4
  • MD5 53a945b06c6ec6a298e905ac5ad5f216
  • SHA1 23fe6ad3f2eb67a72f8e3786849beb3e2c9ebd7d
  • SHA512 21889b689516d79b44b5dd0e30019c026e61917ab493fa45fce687e64ae53e865830787e6c0971fe08c8c7182df9a8c78abc76bd16d6cbe3edb984cda5ab455c
  • SSDEEP 768:EufspTfzcR6uWUcb+wmo2q9r9wSkq/z1OPIozjbKgp3i8IHbVLGVEOBDZsx:EufspTf2g2miVK3o3bdpS8gGGAdsx
  • TLSH
    T13A233A0037E9C12BF2BE4F78ADF26145867AE5633603D64A1CC4119B5623FC6CA52AFD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2