Extracted

• • Target
    0d32b5983966188702086fc53975bf81e9b52ef00a82ba2f962664c78c707e56
  • Size 45KB
  • SHA256 0d32b5983966188702086fc53975bf81e9b52ef00a82ba2f962664c78c707e56
  • MD5 0c53add1d28a00db6aa9c6e73cd8086c
  • SHA1 10cf402e64527ed97aba676a114c4384162dca0c
  • SHA512 ae65d14ed10aa5a4fbc96ae1b955425e1983f53b4a2512c0a4d59e91332e1f9f68cdf9cfe23f7aeb068f061b5ca64f5e16d802859d65b2bb85425b13f1c4e403
  • SSDEEP 768:wuZ8pT1Uu4/cWUeT66mo2q1nLiE0yFjrdjYkk8PIuBjb4gX3i1hogt7TfPWEEmB8:wuZ8pT1tc2KLBXQBuRbvXSLfPWgdMx
  • TLSH
    T1D2231A0037E8812BF2BE4F7469F25245867AF5673603D54A1CC442DB5B23FC69A436FA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2