Extracted

• • Target
    dbf6b70cfb2c3c30c6190be47a5e1f03d2c92d2c01d8d933c3bf36fa63d2c842
  • Size 45KB
  • SHA256 dbf6b70cfb2c3c30c6190be47a5e1f03d2c92d2c01d8d933c3bf36fa63d2c842
  • MD5 77a0fca8a5e83f52156990aefd1a3af9
  • SHA1 c6bff975f170ec873e3325501c64efed08d53140
  • SHA512 045439d3ae1a4dc8dcc0649000f43e2fa7bb0ad8c82c1a4af648a467cd8f6eddaaf4909dd879fff0dacc6562ca5a07760a2256ec2ee322871762efe4f858fc10
  • SSDEEP 768:5udApTNctooWUS7C+mo2qtSCSwTMjPIuYjb7gX3iz3fn44gzC5WXBDZ0x:5udApTNmU2lg1uQbEXSL44gz0WRd0x
  • TLSH
    T192231B0037E8822BF2BE4F7898F26145867AF6773603D55A1CC4419B5723BC69A427FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2