Extracted

• • Target
    32607b32fd1693f2fb762536a33217200cd459b3cba1ab7b1858a78b9eae2887
  • Size 45KB
  • SHA256 32607b32fd1693f2fb762536a33217200cd459b3cba1ab7b1858a78b9eae2887
  • MD5 6c708001a9475c22eb16e3adf7ae1b0b
  • SHA1 330739394423fb3be286772fa9f0300993606566
  • SHA512 346216906786a5c7442b2b43a5e1753e0247b480043e21484eda3cd507cc6c0f71f4bb7319673700666a0bf9142c82769fe60201722693b6fc9f7b4153b01700
  • SSDEEP 768:cuR0JTPUYkEWUmjWymo2q1fLiE0yFjrdjYkk8PIuGjb1gX3icobkkS5UOUPnxjB0:cuR0JTPjY2SLBXQBuqbSXScoABGDP3dW
  • TLSH
    T1E3233B003BE9812BF2BE4B78A9F26145867AF5733603D54A1CC451DB1A23FC69643AFD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2