Extracted

• • Target
    347150290c1f6df4e1190790b317890efb78ee529e18f9eb0fd2fdec06ca19d2
  • Size 45KB
  • SHA256 347150290c1f6df4e1190790b317890efb78ee529e18f9eb0fd2fdec06ca19d2
  • MD5 62a870bd9a3436bc6748e86f6315b5db
  • SHA1 60571347ccc5fab08d901911f1f3fe29585f3e32
  • SHA512 4d7a7ba7640e3c67eb0ca14862dc2376f3b8154203b91489e9f4fd09559c2b765bd8832b0cd8ffa55dd0b352d684f09884ec6ecb8fd261f79ee86ee20f17ec1e
  • SSDEEP 768:EulCJTHESwgWUK3aGmo2q9uW8PIXOPImzjbYgd3i8Ov6PhASLhBDZsx:EulCJTHl42sIu3m3bPdSBv6Pysfdsx
  • TLSH
    T106233B003BE8C12BF2BE4F78A9F26145867EE6633603D54A1CC451DB4613FC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2