Extracted

• • Target
    c84313cf0efb12c2ec242b13489c1921c75db9155f97da94cff6521d3bc7bbe7
  • Size 45KB
  • SHA256 c84313cf0efb12c2ec242b13489c1921c75db9155f97da94cff6521d3bc7bbe7
  • MD5 2a5c5d7c55d294b23d91c96313ccb87f
  • SHA1 ab9ee4eadc6878a1fe5b9a3c0168993d7b0bef0a
  • SHA512 70eb9dda59aba21370ff7373ebff2641acf11e77c083c940aa2a440ca770ce4b3304547a014d2606882177637bc53c58c8ca6518ed45be94afa281a414037c5f
  • SSDEEP 768:vuogpT78XvEsWUOsRzqmo2qr3+GtCV+JtHuPImzjbegX3i0dF/f0w13ppv+lBDZm:vuogpT7I626+TM3m3bhXS0b/8wHpWrdm
  • TLSH
    T1CC232B003BE9822BF2BE4FB898F26105867AF6636603D54D2CC451D75623FC6DA426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2