Extracted

• • Target
    31e3c40f2da05f089a28db1af70b82409ff71187d5af40eefa74bef5799add01
  • Size 45KB
  • SHA256 31e3c40f2da05f089a28db1af70b82409ff71187d5af40eefa74bef5799add01
  • MD5 d519d48f27b3ef593a1bff904c7f6aa4
  • SHA1 59579ca7d4e7c470ba48a640ddb2c5fc8a1a3bd9
  • SHA512 6e4b1a3989a54d05be3cfc11a688f9c29dc771e8699fdc456b4ca7156cb18ec0c2a62a5dadff75f211c397f273e546e42d65d30f2cc9fff7244908d1546ead27
  • SSDEEP 768:suJdpTP3tcsWUODmqmo2qVtBzwQ/x7PIPOjbJgX3iygoKFMZgBDZkx:suJdpTPdI2IaFPibGXShoWbdkx
  • TLSH
    T1A6231A003BD8C227F2BE4FB868F26145867AF5637503D54E2CC452DB5623FC69A426FA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2