Extracted

• • Target
    240c3e64b2d7ac29c53930dbea65a073f8c67c5fb88721f5238a43985747c88d
  • Size 45KB
  • SHA256 240c3e64b2d7ac29c53930dbea65a073f8c67c5fb88721f5238a43985747c88d
  • MD5 8dd796d332b9cb374c9be91613e2b458
  • SHA1 a4e0b9211875ab0eb7751fbda55bf5887aea588f
  • SHA512 a71a7d12a2a87d25479dbc0df923dd1f6f34b3312ec0fa2807adf4cf6c9612de4c6bcc26b59cacb512cffb592646620bcd435e81834d0d21a5a850b018ddd66f
  • SSDEEP 768:wuDWZTpw7bmaWUg3gSk0mo2qlgzdAAyPMlL8TfPIMDzjbogX3uPgUzx8e4slHwad:wuDWZTpMZSB2JlvlL+4MD3b/X+IkWgQC
  • TLSH
    T1B5231A003BE8812BF2BE4B7899F261458A7AF5733603D54A1CC452DB5713FC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2