Extracted

• • Target
    de35b4941d561bb787b18f77359fcba9c2ad94c8911e9ec3a2a978e67bbd1794
  • Size 45KB
  • SHA256 de35b4941d561bb787b18f77359fcba9c2ad94c8911e9ec3a2a978e67bbd1794
  • MD5 98e97520e438e297e193e8f74b90d1aa
  • SHA1 a53e2803e1e90212be14fc35ac914a9476bf7737
  • SHA512 ee60174b7ef501b34a70c4dc6fc07d0e6f3d41c7a7ccd04682add6f3764a87705268442d03b723ae15ffa240883d7620ad0a4b29447eb706ee1d4c5023212177
  • SSDEEP 768:0u1YJTHwAUgQWUaT2Wmo2q9BSEMTFabjOPIM1zjbngX35ZN48ydIfU/ABDZ8x:0u1YJTHcw2O2Q/3M13bgXpZN+qVd8x
  • TLSH
    T19D232B0037E8C22BF2BE4F7899F26145867AF6633603D54A1CC451DB5713FC69A42AEE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2