Extracted

• • Target
    e032a47ba2872cc767827740a87b4d30dde0fc191622a459c36d353b2a85349f
  • Size 45KB
  • SHA256 e032a47ba2872cc767827740a87b4d30dde0fc191622a459c36d353b2a85349f
  • MD5 db8ba824e37d94302543d011d8481c2e
  • SHA1 8c38fb1e41c87f8ca115bdd2f11eecb696d99abb
  • SHA512 653687bae82070e3e5a7ba4ae9b0fd3d921462c22ef168c36018e975995ef344f09e0ab33f884df343ad687d94f72a2f1e7a84e3b60e248b5a90685651789bce
  • SSDEEP 768:ruKQpTA8RXNWU5xFrmo2qrJpt0CCM+d4CvS8PIkpjjbYgX3iBusl1LjfNrK1bO3y:ruKQpTAOX2m/CFWBkpHbPXSBusltEbBX
  • TLSH
    T10E232B0037E9812BF2BE4F7468F26245467AF2632A03D54D1C8451DB5B23FC69A43AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2