Extracted

• • Target
    832e2977182648d4432b8aaceecc6757cd633d5cec0819d9c10184a520a81a79
  • Size 45KB
  • SHA256 832e2977182648d4432b8aaceecc6757cd633d5cec0819d9c10184a520a81a79
  • MD5 4d46f2a6cbe08e35366571ac463494b1
  • SHA1 8d3316a3c9596439f7cdb70536cfc4a277f30cf5
  • SHA512 7ee7229e66e40a7b6b712580d7fbab41bfa07519fc3a7a96a83641b7fc94043afa381c906f2a7a449fa6f8965a97c95335f2ffbf2d00a2891fe2050a7a047616
  • SSDEEP 768:wuDWZTpw7bmaWUg3gSk0mo2qlLls5ohEaMPISmjbTgX3iXbwkBIeBDZMx:wuDWZTpMZSB2O44EaxSKbMXSxPdMx
  • TLSH
    T191233B003BE8822BF2BE4BB899F26145467BF2B32603D54D1CC451DB5613FC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2