Extracted

• • Target
    34cb00807a59f7d04e432afb9979c92d7163ce963d62f35a4e6bd44cffed34f0
  • Size 45KB
  • SHA256 34cb00807a59f7d04e432afb9979c92d7163ce963d62f35a4e6bd44cffed34f0
  • MD5 5db2eab63e639dfc59ffe2b133535cad
  • SHA1 7661966222adc50c21f3c87210ba7e10be889425
  • SHA512 bb0420a08887b410cd51542f3ca6bad0a7eafdbc5ce17e82ba2b2dc3c8762d81b4d2963297de2badc773c3d62147c51ada0833c249abb86a1068e1f9d007abfc
  • SSDEEP 768:0u1YJTHwAUgQWUaT2Wmo2q9IDEbHBOjTOPI/TzjbPgX3iC7yy+R2iIQF1a4WjBD4:0u1YJTHcw2HyYf3/T3b4XSC7PRMj6d8x
  • TLSH
    T174231A003BE8C22BF2BE5F7898F26145867AF6633603E5491CC451DB5623FC69A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2