Extracted

• • Target
    035b2bf0a2723ddcff23842f2f2ee47b1f3c0f108934d98a3334b4ab305b530e
  • Size 45KB
  • SHA256 035b2bf0a2723ddcff23842f2f2ee47b1f3c0f108934d98a3334b4ab305b530e
  • MD5 17ee23dbc61201966cbf639130091cd8
  • SHA1 56c24ed06d51831d9b44fa17e9115905b41a9796
  • SHA512 ebaab67502b523bb7b4452f808b9d3245e9bd08d76e4dd0aad812f80e181cdb6f0f0dfa93b5ddbf428ed8076f11fa84888e324c0cbcf1c23ccf5750e896781ad
  • SSDEEP 768:wuDWZTpw7bmaWUg3gSk0mo2qlTSAFcKoabbb4ZhM/RPIAEzjb6gX3ieDe2xMxVJG:wuDWZTpMZSB2YSAvQZh6OAE3btXSMykr
  • TLSH
    T121232B003BE8822BF2BF4FB899F26145867AF2632603D58E1CC451DB5713FC696526ED
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2