Extracted

• • Target
    f324b367b7e7d1474555db8d1c33622f4b9037c7ca08378d7a610b9a10e2be92
  • Size 45KB
  • SHA256 f324b367b7e7d1474555db8d1c33622f4b9037c7ca08378d7a610b9a10e2be92
  • MD5 938ece8a3f7cd4dd70b1ca24d5a8d38a
  • SHA1 89b6d77fcf8a999d14ce2a3b63c256738da2c790
  • SHA512 1df1cdde95e7250337d08897de5a06dc97d65156694050e25f21974538854d409ace007f49f6abb8d4ae9819663d6cc1c13b216b5d6eaf4ae5b643daca7b1648
  • SSDEEP 768:8uuSpTg7GBoWUSH6+mo2qYjK1YJBOPIxq7zjbFgc3iqkkoRxdgBDZ0x:8uuSpTgyf2eiz3xS3bCcSqkkld0x
  • TLSH
    T14D231B003BE8812BF2BE5F789DF26145867AF2673603E58E1CC4519B5613FC58A42AFD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2