Extracted

• • Target
    294b67e2e4c71c63e3d57c9714089000488b1d78098322e15dfa559ee4c5e203
  • Size 45KB
  • SHA256 294b67e2e4c71c63e3d57c9714089000488b1d78098322e15dfa559ee4c5e203
  • MD5 095b28842bacbf319361978603520aec
  • SHA1 2222d7a6e8d6b8299074f68f2c2633a0dfef3eb4
  • SHA512 c15f71e3825e786054ff2af75e5075b794ace5fcb551754a68e87404a9afa746fa9cf300e1b5c8a610955b4dce2cc883526877b556b606157b81c29b0117d96a
  • SSDEEP 768:wuDWZTpw7bmaWUg3gSk0mo2qlb3HO4SNeOPI0Gzjbdg63i5NyNto4F91QK6oKNB8:wuDWZTpMZSB2O+Je30G3bK6S5gNtj3y8
  • TLSH
    T103232A003BE8812BF2BE4F7898F26145467AF5636603D68A1CC452DB5723FC69A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2