Extracted

• • Target
    602f84e950aed6cab18c47243347016ef70237a672b11d1b91d468ec3bf1a6c1
  • Size 45KB
  • SHA256 602f84e950aed6cab18c47243347016ef70237a672b11d1b91d468ec3bf1a6c1
  • MD5 2fcdf5ae098c96901b59963e237bc27b
  • SHA1 4c4e9f74ec0a723ee7882b241147a53105aef31b
  • SHA512 1f18061e81d954872b0e0b4ea306a330ea1167fee6abc1dc42190af211b778ca897e520c630c125bfb85cad68b384058219674f5ae161073e785ea12d3181af7
  • SSDEEP 768:5uSy6pTpwrSWWUE3/WImo2qNrITnyfaaPIGzjbDgX3i2bLdpeQtWJfBuwBDZ0x:5uSy6pTpoo2oEhG3bcXS2Hdp7CBumd0x
  • TLSH
    T15C233B003BEDC227E2BE4F7899F26145867AF5633A03D64D1CC4119B5613FC68A52AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2