Extracted

• • Target
    f32b0b07b687f80ed014eedfa77f9ba25b81f1d3fe3e6e26d88ffc0bc0ab3fdf
  • Size 45KB
  • SHA256 f32b0b07b687f80ed014eedfa77f9ba25b81f1d3fe3e6e26d88ffc0bc0ab3fdf
  • MD5 0e970d51d917dcb04fdba7643f276d25
  • SHA1 7c48c0c27046b1b07c44c71f93ab7234f06aa4a2
  • SHA512 d82df0060c8381393f86e37ee1f420869b8aa65edf737469334f1294f7f6f536228fedb3602bd826a55a58ac71e7ff3032d8284c18e5c2f3b2b056466b36733f
  • SSDEEP 768:8uUIpT4vvofWWUEXb+Imo2q4riD8yfzuOPIZzjbkgXLi14aekblD9hDsBDZ0x:8uUIpT4vAj2/iAJ3Z3brXG1MkblD9hD1
  • TLSH
    T1032319003BE9812BF2BF5F78A8F26245467AF6632603D6491CC4529B5713FC68A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2