Extracted

• • Target
    d31bc2351803d9f4daae9a94af6b7f44f629bc0489b4d75a0a123876d72be3ed
  • Size 45KB
  • SHA256 d31bc2351803d9f4daae9a94af6b7f44f629bc0489b4d75a0a123876d72be3ed
  • MD5 3c0c86f566d4ca42f7f1f801a9c85719
  • SHA1 aea63b4ba5187d0419ae650ec623076f6a329a24
  • SHA512 8f3d24072366f45b8d361db66ef54a5641e4972b30b1ef4a5bd2ca8d2416477c1692d9e0baef9b98bfe09d0c3bde0489dccd41d9a93d1d5a6d9f08e3dd9f415a
  • SSDEEP 768:0u1YJTHwAUgQWUaT2Wmo2q9aCSwTMjPIuljbEgX3izu1Cf8+FuwPUBDZ8x:0u1YJTHcw2Ng1utbLXS8QLid8x
  • TLSH
    T151232C103BE8823BF2BE5F78A8F26145857AF6633603D54D1CC441DB5623FC68642AED
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2