Extracted

• • Target
    242af3e10eb3f484073b8c3fa9938dea1a5b0d063320d84ddaa788b02726562e
  • Size 45KB
  • SHA256 242af3e10eb3f484073b8c3fa9938dea1a5b0d063320d84ddaa788b02726562e
  • MD5 9dbc2b958d82313de1e4226996d8ec24
  • SHA1 a9da699880cb8f2eb3ba848399fe350988e7d47e
  • SHA512 df329aa3e3cfc1b6a4633bf20e715003f169f0c9cbd80d2125267663d5b511ecc2478b61faa1a5a4bf41fb87124bf46430150741fbbf6446001e562704dac203
  • SSDEEP 768:wuZ8pT1Uu4/cWUeT66mo2q1nLiE0yFjrdj3kk8PIhbjbOgX3idc8ypnw7dxDQPVu:wuZ8pT1tc2KLBXDBhPbxXSdcR8d1QPD8
  • TLSH
    T1E0232A0037E8812BF2BE4F7899F26145867BF6632A03D64E1CC451DB5723BC68A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2