Extracted

• • Target
    337c9e8febd1e23a98dbceee2b2e7b4ceeb0b5ad3d8510f5d125b8884a94a433
  • Size 45KB
  • SHA256 337c9e8febd1e23a98dbceee2b2e7b4ceeb0b5ad3d8510f5d125b8884a94a433
  • MD5 b381742d70bc1e1eb78bac38b6704519
  • SHA1 670804b89f3d5127c180e819177e9d5da794fea3
  • SHA512 5b638eb957d6f49037c2916afcae429529109d113cb5a54bd461cb3014c3229e470d4051cfaff01bfafbd3738470dc093e9dfb27a3ed4ee04c7e8c87078a85a7
  • SSDEEP 768:wuDWZTpw7bmaWUg3gSk0mo2ql43Fo9EaOPIGzjbjgX3idUpRxsjaeBDZMx:wuDWZTpMZSB2J8Ea3G3b8XSipRqFdMx
  • TLSH
    T1FE231B003BE8822BF2BE5B78ADF26145467EF1A32603D54E1CC451DB5613FC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2