Extracted

• • Target
    2419d9b56c647af5eae1ad3e09b9eb6d743f645e2f00d19c1c320fffb8b762a2
  • Size 45KB
  • SHA256 2419d9b56c647af5eae1ad3e09b9eb6d743f645e2f00d19c1c320fffb8b762a2
  • MD5 503c7fe3d0c9bc4657624fe2be495e5b
  • SHA1 9908dcb8700029da9659146f2e6287f95089ae8f
  • SHA512 f53f62b3698926220619d90c0cf56793ded2328f2512d01678f790039e0c4240bf6d72ad45ce2788da2a51a1d62676683d599ced1466ed6159c390109d776a9b
  • SSDEEP 768:UuKWgSJTwU6NkWUGnaSmo2qAeb30GYjHuPI8zjbagX9iwIRgBM5rK5/zMYE5BDZe:UuKWgSJTwRf2uw/383bNXMuBM5rKBhGs
  • TLSH
    T1A5233A003BE8812BF2BE4FB898F26145467AF6637603D6491CC451DB5623FC6DA426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2