Extracted

• • Target
    30500511c617f37cc12685c0d4df6dc62873cab1ffec1c21cbb422664b6be067
  • Size 45KB
  • SHA256 30500511c617f37cc12685c0d4df6dc62873cab1ffec1c21cbb422664b6be067
  • MD5 af8598886ada0a93a5bb0779e0664aa2
  • SHA1 3c204effb720d5ac07e8fe0fbe78b35d77778eba
  • SHA512 8e511d09263d6fcda1d81021edd086427c1cfc1923433fedb49910a01d266e8ce762bde51e95edcfe0699353f0a7872bbff5c8b4f6febbdf1827536c0ad5d541
  • SSDEEP 768:ku40ZTX3uXTaWUgzW0mo2qwP3Fo9EaOPIRzjbEgX3i2UrlOC9r95deMBDZMx:ku40ZTXEb258Ea3R3bLXSV98KdMx
  • TLSH
    T1F0232B003BE9822BF2BE4F78ACF26145867AF5636603D54D1CC441DB5713BC69A42AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2