Extracted

• • Target
    0234e586f4e4adfb319e5a22eaa8bb5a4e0c44b4f3abbaf5c6d1a105892d00fa
  • Size 45KB
  • SHA256 0234e586f4e4adfb319e5a22eaa8bb5a4e0c44b4f3abbaf5c6d1a105892d00fa
  • MD5 0211775da0838fd4136370f338a5c30b
  • SHA1 02e1e64adbe976cde7f0648abe68bb0dff57a70e
  • SHA512 6532252b091d904ddd2929ede8824c02f615b1556a005fe5c9da46e07f7ca95ab4753c379e5f4fdcb2c9797cfd0340afbc88de03dfaa3e827d3140b36cbceef0
  • SSDEEP 768:0u1YJTHwAUgQWUaT2Wmo2q9m6R8aI3OPIOzjb1go3iOY5g6Pmyi+BDZ8x:0u1YJTHcw2Z+FO3O3bSoSz5gs7d8x
  • TLSH
    T1BE231A003BE8822BF17E4B78ADF26145867AE1673602D68E1CC451DB5613FC69642AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2