Extracted

• • Target
    25c5b50483cf9fe893593b28b11bd3b3d8a52de18c04efd15fd1e52c93f8464c
  • Size 45KB
  • SHA256 25c5b50483cf9fe893593b28b11bd3b3d8a52de18c04efd15fd1e52c93f8464c
  • MD5 94ba2ccc34012365319adc179feaf193
  • SHA1 bcca58ca97f5944802856d984a2008f4d084dd90
  • SHA512 8b1da8cd821b5bb742246118f420957ac6f7508e5eb11474db78f483adce0a59fc0bd030cbf5cad4b0982f72a189cd7d0082ae0871f574ccea3c660e0bedd0db
  • SSDEEP 768:QulLJTEs+EgWUKJTGmo2q9YK1YJTOPIxnzjbWgh3ipndzaumDQdIeAio3BDZTx:QulLJTE9X2iiZ3xn3bJhSpdpyPeYxdTx
  • TLSH
    T1C1232A003BE8812BF2BE4F789DF26145857AF2673603D68A1CC4519B5713FC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2