Extracted

• • Target
    307d320289fc653426effa81efe344ee010f5c484bdfdefe1ba24d266e991eb9
  • Size 45KB
  • SHA256 307d320289fc653426effa81efe344ee010f5c484bdfdefe1ba24d266e991eb9
  • MD5 b1bb584410a9903731b57fd9a406f184
  • SHA1 766cb2c9f049169a564977261e8922ee974e3c1e
  • SHA512 a0d81fa9b407893d0045769c674f570d9c37ffd03ed71196e812935acd48e60f626a9e9dac4479b03170cd0ad280294faa8cdf458154f81aac2e8821b4ef16ea
  • SSDEEP 768:cuR0JTPUYkEWUmjWymo2q1fLiE0yFjrdjYkk8PIuzjb6gX3ip0O+r5lE+zZuDyA2:cuR0JTPjY2SLBXQBu3btXS+nvEMZuDyB
  • TLSH
    T10F231A003BE9812BF6BE5F7469F22245867AF6732603D64D1CC441DB5B13BC68A436EE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2