Extracted

• • Target
    3257d7bd157488d59a8bb28b12006f72756b84965aefeb161563e42fb537872d
  • Size 45KB
  • SHA256 3257d7bd157488d59a8bb28b12006f72756b84965aefeb161563e42fb537872d
  • MD5 5f9ad5d90abc99257b05ae05ecde37fa
  • SHA1 d7665e11ca317c9fea94e9b565c9da36d188fb68
  • SHA512 bab7065d49cb5749019c990b9b771b010738221a73f237283f3df789908a7ea578a04824e15f81819b35eac6c70a4b227649b2c9ca2affc7c848afa0029036ab
  • SSDEEP 768:8uuSpTg7GBoWUSH6+mo2qYrZo3TMtPIQtjbegX3ifdT9X/8YHyR4BDZ0x:8uuSpTgyf2tU3QlbhXSfZCYHW+d0x
  • TLSH
    T117232B003BE9C12BF2BE4F78A8F26145867AF6673602D54E1CC451DB5623BC6C6426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2