Extracted

• • Target
    38be5d1ba5b52aa345f5e3b3a295b485a2b27d0c3fed21a95f8c54ac7db0833c
  • Size 45KB
  • SHA256 38be5d1ba5b52aa345f5e3b3a295b485a2b27d0c3fed21a95f8c54ac7db0833c
  • MD5 6dc10c41cf96a4c818fc609a0fce84ff
  • SHA1 cf1ba89d6000623565c5bde1f4fe8ffd5fde1fe6
  • SHA512 b200bf58923fd699eff3d50a5b06d3c8ec0253c8f2158ccc7504d986253bce023c0e2f766f646174b09e778e38aea9441310e9150308d29a946b104881daa844
  • SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFylsHoPEaMPI1hjb6gX3il4bUY0XBDZEx:MuLAZTnbg2XuuEax1xbtXSliUY4dEx
  • TLSH
    T1DD232B003BE8812BF2BE4F789DF26145857AF6633603D54A2CC452DB5A13FC696426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2