Extracted

• • Target
    382fc884af6de9896270ddf06de3df6c168e0b9a5ea1f6ca6490ed43780e1509
  • Size 45KB
  • SHA256 382fc884af6de9896270ddf06de3df6c168e0b9a5ea1f6ca6490ed43780e1509
  • MD5 1a5b5cfff3ec9444530c39766358b13b
  • SHA1 b91363cb01a7742674a632bbb7e4f71246b93114
  • SHA512 21cb8fd8c294485effb69925ae0c92e24ff2e87f1c7a763c4cf4e3dbdb90527ebf151a042271abfb1914e5dfe1ee6f4f62df17871d2e0b507988a7e459646d0c
  • SSDEEP 768:kuSOpTPTCFcWUeXa6mo2qAM0e3+KvP8iZPIjzjbbg03i6TnP6GscFh7J0BDZMx:kuSOpTPOP2e3TsiWj3bk0SAbHdJCdMx
  • TLSH
    T137231B003BE9812BF2BE4F7898F26245867AF6633603D5491CC451DB5613FC69A43AFD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2