Extracted

• • Target
    32a70ffea065135f9ca4f170629c0984f0ce2f6fb4fa9781548e585ade517807
  • Size 45KB
  • SHA256 32a70ffea065135f9ca4f170629c0984f0ce2f6fb4fa9781548e585ade517807
  • MD5 eecb8ff25c6c321ce1e5a31c660d93e3
  • SHA1 2413fa60cda939b65241a3df07945d977c11d2ea
  • SHA512 f9dd4f180248bf8557de6a2473f185e78153d68c6f957ff236f2625479121034e3332bc392eb6407698e965d17e661fd1a45fd8d8b439a4599117f6b4fa82641
  • SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFEfBohEa+PIvgjbZgX3iNU2ehMCnRiUBDZEx:MuLAZTnbg2Z4EaHvIb2XSGhDMidEx
  • TLSH
    T152232B003BE8812BF2BE5F78ACF26145467EF6636603D5491CC411DB5723BC6DA42AFA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2