Extracted

• • Target
    314c5902c4e9ac4160ba380a3aad1ca6e0f6333f162b5ef341b60367581d4f88
  • Size 45KB
  • SHA256 314c5902c4e9ac4160ba380a3aad1ca6e0f6333f162b5ef341b60367581d4f88
  • MD5 31825e2963c46955554b03e302c60dca
  • SHA1 31460a7afdf8571f27061029ada04a7e79961300
  • SHA512 c4e124d383c64d7855082e7851a9d4550e1e88726192e66b864fc03b366afd243b0ecdbc7c04619bbe28dc2d9ea34a1dc0d119f5873820366545d9324cb89113
  • SSDEEP 768:0u1YJTHwAUgQWUaT2Wmo2q9m6R8aI3OPIOzjbNg03i5sT3aKbZFYFTjBDZ8x:0u1YJTHcw2Z+FO3O3ba0S+BFYFTld8x
  • TLSH
    T167231A0037E8822BF2BE4F789DF26145867EF2673603D68A1CC451D75613FC68A42AED
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2