Extracted

• • Target
    381d2b6d4875cb06cdb00409a9e16e1aabc4bd9b13c0dc92d17ccb17d8b6e936
  • Size 45KB
  • SHA256 381d2b6d4875cb06cdb00409a9e16e1aabc4bd9b13c0dc92d17ccb17d8b6e936
  • MD5 39378096be9ef2d9662c07cce1f64a43
  • SHA1 9c8184a94910791f0ca9ce75faf2a0258d67e5d2
  • SHA512 abac8595ba0e62f885667bde822b7aa578e6bb9e5e8306e95d5b325847e5e15cc2cbb54397bc7a338a81f88cc06bd4cad6f0bf4b12add6e016d73ac3cb20b2a6
  • SSDEEP 768:suJdpTP3tcsWUODmqmo2qVCT2Qpm7PIKZjbIgX3iNH4GTeimsOiRkBDZkx:suJdpTPdI2+eKZbfXSNTBms/Sdkx
  • TLSH
    T129232B003BE9C13AF2BE4F789CF26146467AF5672603D54A2CC451DB5723FC68A426FA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2