Extracted

• • Target
    34e54986dc8d95887081086104bf64665463523d7d3b09cde1cd433d89f63258
  • Size 45KB
  • SHA256 34e54986dc8d95887081086104bf64665463523d7d3b09cde1cd433d89f63258
  • MD5 04e136b4d1b43f74d7b28e9e51ea2856
  • SHA1 ba5aac04ced7e95c0c5654999c504b171af9ea5d
  • SHA512 50e7de6b489c55a7726cddcf5ae8b973cc4f41484a8cbc697bcc3df275e9141d9ce14f38fec4a9102e053898a7229aca866fe60e35112a2bea3dc76de818d338
  • SSDEEP 768:EufspTfzcR6uWUcb+wmo2q9L9YqPq3hOPIezjbkgX3iC6rUxgU1TWfqDBDZsx:EufspTf2g2Gaqq3e3brXSxUGiHFdsx
  • TLSH
    T117233B0037E8C12BF2BE5F78ACF26145467AF5733603D64A1CC4519B1623BC28A52AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2