Extracted

• • Target
    81cd69fcd77e5f1c2cd4c133e328b209338d02f54ca768bcf4741ebf06b57752
  • Size 45KB
  • SHA256 81cd69fcd77e5f1c2cd4c133e328b209338d02f54ca768bcf4741ebf06b57752
  • MD5 9cdc8c7dd66851e21d8c776ae8ff94d5
  • SHA1 2ed8a4caa639eefb7ce08d1c49f2d9c34015158b
  • SHA512 e945d2a7074e1a404ddb867cd67f10134189c4d3836787eee58462f71f595fa9f13807d30daa125ef9e2c863060ff92cc33a704dce2ac13711e7a6c9a6180b76
  • SSDEEP 768:8uUIpT4vvofWWUEXb+Imo2q4UwD/y/aqPIUzjb3gX3iGMA2NKRKRkLXBDZ0x:8uUIpT4vAj2wkhU3bQXSG0gRKOVd0x
  • TLSH
    T1D1233B0037E9C12BF2BE4F7899F26145867AF6633603D54A1CC412DA1723FC69A526FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2