Extracted

• • Target
    531bd0f9bfb234f0d73c40856fd41e3fdaa105ece62ab87c8cf2a8812fb72a6e
  • Size 45KB
  • SHA256 531bd0f9bfb234f0d73c40856fd41e3fdaa105ece62ab87c8cf2a8812fb72a6e
  • MD5 7f6ca15d47a9054c0d5ea0e611fde37b
  • SHA1 c294aeaa23af928b52ef39264495dc137f082395
  • SHA512 148596123be3643f79df3450a71695561248bbe310ca74a6bb042acf13a80cb4df0aed30c1229ffc691d89903c40344b67d1b197d62913b75be681402f37ffd8
  • SSDEEP 768:cuR0JTPUYkEWUmjWymo2q1J0VllV16GcPIbzjbDgX37yFAmXlHMavUPWBDZUx:cuR0JTPjY2u0V/v6Ghb3bcXLOplHlvUr
  • TLSH
    T1DE232A0037E8813BF2BE4F7898F26145867AF2633603D64A2CC451DB5613FC68A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2