Extracted

• • Target
    39e82955d16e951e5fa4d47630b2b2a290d3c37def9ae208ebece6a0677fde8b
  • Size 45KB
  • SHA256 39e82955d16e951e5fa4d47630b2b2a290d3c37def9ae208ebece6a0677fde8b
  • MD5 e8df604f42c5832ced82d480156df528
  • SHA1 b8014368450bf41e80861dd783ea77f3af8ab807
  • SHA512 08ce41f234743c53a377bc1f1e0de37c948621df39c5f6eb557cdd46db240c708f2b8785e1a798fc2b2d579c6d8780019350c7039487a7de3f2047f29da34aab
  • SSDEEP 768:0u2vpTD4U2ieWUsqfAmo2qjMzjHy/aKPIbFjbGgX3i4e6gm6FubTGY3bBDZ8x:0u2vpTDe+2FnhbNbZXS4eOEuWwNd8x
  • TLSH
    T1B0231A0037E8C12BF2BE5F789DF26145867AF6632A03D5491CC412DB5613BC6CA52AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2