Extracted

• • Target
    34abaf2ec93a593a1fbc891b45aaafd818a0b5edad62a530191309bd22853251
  • Size 45KB
  • SHA256 34abaf2ec93a593a1fbc891b45aaafd818a0b5edad62a530191309bd22853251
  • MD5 65d6da6ab33399d23e78cb01003ad94d
  • SHA1 1a09b3b0f0f85a333fd158918801f61fbf4506ba
  • SHA512 6b15f4d0f5b2e2d8c34c80f8b47d3984cee84afe9d73ffd256e084ed3f3d8fa1f4d1129fafe43b82a2385c8c946828fbe6668a43fbe483ab3467d29b2d0dd408
  • SSDEEP 768:cuqb5TrIGuCWUoKXMmo2qQcSAFcKoabbb4ZhM/RPIAEzjbGgX3ivbt0vu4o3i8/m:cuqb5TrhG2gSAvQZh6OAE3bZXSqvZUiF
  • TLSH
    T1A0232A003BE98127F2BF4FB8ACF26145867AF6632603D59A1CC4519B1713FC69A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2