Extracted

• • Target
    35a07a7499c8f7a35beca6827229d2b0c8dfe47c8cb0daf75beec7d89018c91d
  • Size 45KB
  • SHA256 35a07a7499c8f7a35beca6827229d2b0c8dfe47c8cb0daf75beec7d89018c91d
  • MD5 75a8db537295b5ae0be9c60c6d56fa92
  • SHA1 31bc0d0652ca63546639e24dcc2d0b0cc53adbc4
  • SHA512 34b98247da1860d9d86eaf5742dd84f2dfeaa97727ed019d48863371155f83b88c13783670b3ace79a8bbe9f3b4017c428bdaa427e014d5fce44b7f8a72f44ca
  • SSDEEP 768:EulCJTHESwgWUK3aGmo2q9zCOtTMtPIazjbggX3id8mwAlTPfxWKT0FzSnBDZsx:EulCJTHl42MRva3bHXS2mwuTcKLdsx
  • TLSH
    T1E6231A0037E8812BF2BE5F7899F251458A7AF5637603D54E2CC442DB5623FC68A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2