Extracted

• • Target
    33df50303f02d088acd1041309cb1e06190e18e840f40c5725feac21b6dd53f7
  • Size 45KB
  • SHA256 33df50303f02d088acd1041309cb1e06190e18e840f40c5725feac21b6dd53f7
  • MD5 317f67ffa19627ecbe5a32a08837178d
  • SHA1 e502c7faf23d1b7afc97cd2da0b99be4a96f1c32
  • SHA512 6dea36e5974ca950471e48936eb41c0f85ed88ddc0c79d5118d8c00aa3e01529b5f2a3f5f322aa5616dff8d2ddc8865427e2369b6214fcafed53782f2bf38702
  • SSDEEP 768:ku40ZTX3uXTaWUgzW0mo2qwvBlte40WMOPI0IzjbagXdiPf/MIKtwEey0EBDZMx:ku40ZTXEb2F2UM30I3bNXsP37ty0ydMx
  • TLSH
    T146231A003BE8812BF2BE5F78ACF26145867AF6777603D54A1CC451D74613BC68A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2