Extracted

• • Target
    309890ed8a47f068c42d03870a99cfebbcae40d5c777bfd3099d1a92f319e33e
  • Size 45KB
  • SHA256 309890ed8a47f068c42d03870a99cfebbcae40d5c777bfd3099d1a92f319e33e
  • MD5 5b38c82c43a8853ac1b15668c7db7ea1
  • SHA1 f04ba9b67114231bba93f1e78af415dc290aa0ec
  • SHA512 1dc76994718c0913c7900192a494c50243315674752f15bda1d65f7542797f5de893bb366ec9538194f76aeaa46e2f57a81176231e7f7a2f1e739bdeb55bd509
  • SSDEEP 768:8uUIpT4vvofWWUEXb+Imo2q4T9YikqHztOPIUzjbogP3iCkTVgBDZ0x:8uUIpT4vAj2XalK3U3b/PSCkTsd0x
  • TLSH
    T10E23190037E8C12BF2BE5FB8ADF26145467AF6633603DA491CC4519A1723FC68A526FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2