Extracted

• • Target
    533b658c040449206684ebba40b32fd9a0d1137d743d82137e8d5d3f2eab0e28
  • Size 45KB
  • SHA256 533b658c040449206684ebba40b32fd9a0d1137d743d82137e8d5d3f2eab0e28
  • MD5 dbdb251ddb883a3a9eb20d2c0e5cdcf9
  • SHA1 2b1d2a8451fde93cfe01d63d6f779f9a63152a5d
  • SHA512 b6d7c942b687cbf4af9041072b7d4595faa2d2c33b04a1a0049095cb421e14ec6a400519090280e55a5188dbc9bcf5a6bb4f2cddd8e58d42ce0e983032141504
  • SSDEEP 768:8uuSpTg7GBoWUSH6+mo2qYEZoQTMtPI4Jjb2gX3ioi9IJBKibL79RBDZ0x:8uuSpTgyf2sL34pbpXS+Jj1vd0x
  • TLSH
    T1E6232C003BD8C12BF2BE5F78ACF26145867AB6637603D54D1CC441DB5623BC68A42AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2