Extracted

• • Target
    603fa9c24180473a832f4fe53ceb64975ae8d0e56bb3abcfa1cba45196012319
  • Size 45KB
  • SHA256 603fa9c24180473a832f4fe53ceb64975ae8d0e56bb3abcfa1cba45196012319
  • MD5 ab5b6914fc03dea9cc5ac2014ae80f94
  • SHA1 e74da6704e59619a0c4dfb573e2838de3c328340
  • SHA512 39fa3a434e1826a789afa96dd0449098dee926cf572ed4fff0de972f9cfefb7ad3da72ea17dce6c6522232073e60698ae1b56df28d9b2e780734251e1f276f46
  • SSDEEP 768:wuZ8pT1Uu4/cWUeT66mo2q1nLiE0yFjrdjYkk8PIu8jbHgX3iP+ZJfVEUDBDZMx:wuZ8pT1tc2KLBXQBuMbAXSPA9EUFdMx
  • TLSH
    T1B3231A0037E9812BF1BE4F78A9F26145467AF5632603D64E1CC451DB5B23FC68A43AEE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2