Extracted

• • Target
    235a20f48817af6ec5ceb287079adb4d4c0eecef86ec2d027198aedd9d1235f6
  • Size 45KB
  • SHA256 235a20f48817af6ec5ceb287079adb4d4c0eecef86ec2d027198aedd9d1235f6
  • MD5 329365bed1ae36812d6aedae9329ad11
  • SHA1 e2436e2b8a379f7ce4c314101f55cd70451ec99a
  • SHA512 d33646112c2f2da267a9a4c0096db7c3188bd754988e8577bbb554892dac3a5e339eecb66e017d7b969cb8c0af2418e0a062289a334a60a935d25674c384f28c
  • SSDEEP 768:0u2vpTD4U2ieWUsqfAmo2qj4ozfy3CKPI0HjbUgX3iI6REYuh1SGJM/7azzPABD4:0u2vpTDe+22TR0Db7XS1REYuTSGJ8yzR
  • TLSH
    T166233B003BE9C127F2BF5F749DF26145867AF6633603D68D1CC0129B5623BC58A426FA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2