Extracted

• • Target
    229605744328e5de7ff083fd56450c7ec2b6528f7e8e7c8c886f089a8a57d7f5
  • Size 45KB
  • SHA256 229605744328e5de7ff083fd56450c7ec2b6528f7e8e7c8c886f089a8a57d7f5
  • MD5 1500d853c19932dbf5fadacd90ff4f59
  • SHA1 34c58f2b16c197c8f18fe9dcda0701176ab0f35b
  • SHA512 df2ba6c885203a2a5020834bd125c0af1c186e62de0eea9db56ac7f934bea48de5d0f205a17b3af480f273bbc795128ff80d9eace58047d175594cd7f5647fa6
  • SSDEEP 768:EulCJTHESwgWUK3aGmo2q9VxQHJcOPIcUzjbjgS3iSSPre35oQkOmBDZsx:EulCJTHl42esW3cU3b8SSw5oVOodsx
  • TLSH
    T197231B0037E8C22BF2BE4F7898F26145867AE6673603D58A1CC451DB5613FC69A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2