Extracted

• • Target
    24f241b1b2dc5dd1c436a5e37d73a1ff3282d932b893279690ca133672ebc288
  • Size 45KB
  • SHA256 24f241b1b2dc5dd1c436a5e37d73a1ff3282d932b893279690ca133672ebc288
  • MD5 8955b42b5df4e6edbfe8b09219b7ac3d
  • SHA1 57b3ac33ed2660ee975a29a824ae5f2201c5982e
  • SHA512 8ca963980eaa0658f808093066bc55a7538e6ec7e7c66d460443504324adb5fd809742d977720f7e0884bfce5955e5d318fddf578e653fe939d30a771b84eaf7
  • SSDEEP 768:MuBGJTP0BQ0UWUWHaimo2qVh0eUNEARViZPImzjbWgd3iNZxVqvp45Mz1BDZEx:MuBGJTPho2EUe+iWm3bJdSNZxVqq5MvE
  • TLSH
    T15A232B003BE9812BF1BE4B78A8F26145867AF2637603D5491CC451DB5B13FC69A43AFD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2