Extracted

• • Target
    31e9abf0027b80fd2a6789c5f168b09361cfd89a28a1f0c90033916f06b2e016
  • Size 45KB
  • SHA256 31e9abf0027b80fd2a6789c5f168b09361cfd89a28a1f0c90033916f06b2e016
  • MD5 e28de4656f8483691bb830f95f5da80c
  • SHA1 ae892f69c9e7c9e6ce3727cc752798fbe0661bdb
  • SHA512 f2a63f11e14fa5c64efa951b788d2b0cd6e9c04b669b4e5723fec4bb2dccaf0a48086e8d6bb9f8acd9dd040789c8ef8970c4fbc951d43418f0d13b3b5c160354
  • SSDEEP 768:cu6RaepTPYzbs8WU+Xaamo2q1mGsGx8OHuPI2zjbEg53iGbqmt0kZDvYmBkNcPT+:cu6YepTPso2rez323bL5SGbqmpDRbTp0
  • TLSH
    T179231A003BE8822BF2BE5F7498F26145867EF6676603D9492CC441DB5623BC6CA426ED
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2