Extracted

• • Target
    31ff174a8ca9b0817f76fffea806e6367ae4968a5cc77bbfcca4c16cfd158848
  • Size 45KB
  • SHA256 31ff174a8ca9b0817f76fffea806e6367ae4968a5cc77bbfcca4c16cfd158848
  • MD5 dab3a6148ab304a35c39632a3cb409ef
  • SHA1 4e6de9805f404aed79265c34d862142e34305d35
  • SHA512 6551f444dc5fccd63c82c2ee01e28cc6352e29cafd38edcac84177e283102d5e4486979701931295fce8e564751073f38ac6b1fa7bb31ae7059a301c6653dcd1
  • SSDEEP 768:kuSOpTPTCFcWUeXa6mo2qAHBjusyQowsPIWzjbDgX3Z8kbrJYKArNBDZMx:kuSOpTPOP2XBjuxZwRW3bcXJ8k/4/dMx
  • TLSH
    T10B232B003BE9C13BF2BE4F7899F26145867AB2632603D54E1CC441DB5623FC69A826FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2