Extracted

• • Target
    33dfda116dee59e6a09cad5c6be7512614e3d1a5a35c355fd1b22c76d0207323
  • Size 45KB
  • SHA256 33dfda116dee59e6a09cad5c6be7512614e3d1a5a35c355fd1b22c76d0207323
  • MD5 987c64101989d6e522bd97f849893743
  • SHA1 ebbbb1a5d7cb83a311a7e5c9fc34ec3053578b1d
  • SHA512 cc8b6141b40d6b5c6e4d7c3fbdaebc5be25fe02ade2ab4b1dd8f179621f3dd2b12b70723eb07a1d13dd286737ecb454ce99047927f84d56e39ffae7a6714ee4d
  • SSDEEP 768:5uSy6pTpwrSWWUE3/WImo2qNK9wa0y/zFOPIuzjbkg73ifPz5oU2AliBDZ0x:5uSy6pTpoo2HCdi3u3br7SfPz28lcd0x
  • TLSH
    T1B7233B003BE9C12BF2BE5F789DF26145467AB2633603D6491CC451D75723BC68A42AFD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2