Extracted

• • Target
    335c0791590662fd00d8e7f127596a346f15746b20c31dfcb2031d57b42117ab
  • Size 45KB
  • SHA256 335c0791590662fd00d8e7f127596a346f15746b20c31dfcb2031d57b42117ab
  • MD5 55bbb1085395d4bf4b232cbb3ed82a6d
  • SHA1 4a9d2252455362d7bcc1a2be3ea9318e231db1a1
  • SHA512 78d5ea45fa69e5ba1588b3d2ab2ea5b87314bb3de954c19adc6b5fbb212f5ee9baf11b755662ff769cdd5c54f6bd283251a337fa55727110eea4ff5cec86e860
  • SSDEEP 768:suJdpTP3tcsWUODmqmo2qV+xJdxCPHuPIXzjbog/3iuL4IC1qvNBDZkx:suJdpTPdI2DZc3X3b//SuTOq7dkx
  • TLSH
    T10A232A103BE8812BF2BE4FB4A8F26145467AF6637603D64D2CC441DB5623FC69A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2