Extracted

• • Target
    32e97eee351f6e87eef6b82a3c718ad485d91642b5f401d64968f3ec2769d57f
  • Size 45KB
  • SHA256 32e97eee351f6e87eef6b82a3c718ad485d91642b5f401d64968f3ec2769d57f
  • MD5 346ee3af821ff5f4726f30f60c6dc6bd
  • SHA1 c5cc6923978ac5e653e2b525154dd47f2239468e
  • SHA512 3cf7c3fed5098d873788ef2c573f258f27ce1228360a86c348d37b7ad4a10fd994f81ae6bfea19b6bba623ab72ce1a28507d28083a430c1daffee5494ecf5339
  • SSDEEP 768:5udApTNctooWUS7C+mo2qtpSEMTFab4OPIM1zjbLgX391Nh/+3MimarBDZ0x:5udApTNmU222QE3M13b0Xt1Nh8Mi79d2
  • TLSH
    T137232B003BE8822BF2BE4F7899F25145867AF6673A03D54A1CC451DB4713FC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2