Extracted

• • Target
    33ee7d78f15dfd5bd9a339bedddc19c85ed2bf79e6b3001e2e1c6061a405cba4
  • Size 45KB
  • SHA256 33ee7d78f15dfd5bd9a339bedddc19c85ed2bf79e6b3001e2e1c6061a405cba4
  • MD5 5ab2e6cfea3a11b7c9d33d739cada97a
  • SHA1 cfdf27c55b144447ad17287e464b5ed2bc4b2f75
  • SHA512 6cd4701a37f4b33289c515e17c5a1f54ade32e3db1f0e45f39edc855e64660640768ac9be58bca87f822af520a45d6eafabc1df890cc935a2cae0aabced8eb0f
  • SSDEEP 768:RuxkJTVmU5EkWUGMKSmo2q1WT9Qpm9PI0zjbOgX3iO25t1sQAOJfBDZcx:RuxkJTgip2BQ03bxXSOOt17Aqdcx
  • TLSH
    T18E232B003BE9823BF2BE4FB89CF26105467AF5636603D54D6CC451DB5623BC68A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2