Extracted

• • Target
    30989dc5bbecc6825cb4d1e4efd1ca9923e4edd80a8af5cbc99e0941502b97ca
  • Size 45KB
  • SHA256 30989dc5bbecc6825cb4d1e4efd1ca9923e4edd80a8af5cbc99e0941502b97ca
  • MD5 9bc5ddd846ceacad885473a323174196
  • SHA1 20a5629d08dfb6f901ce6e79a7b3bbef9598ac55
  • SHA512 7e6a6c1fa0aa4100a11b3fd3f4da8ddc4e968678ccdf85e90053ea73abc91e30d3e450647a1c90d30e339f5f7e3b74b1035d0ce261b22cf913eea88257eb9e98
  • SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qF1Nd3u40cMOPI04zjbGgXZiXY/jDwPn/uMiPzBDZEx:MuLAZTnbg2m8+M3043bZXoXSDwv/Vi9E
  • TLSH
    T1DA231A0037E8812BF2BE4F78ADF26145867AF6736603D68E1CC451D74A13BC696426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2