Extracted

• • Target
    30c764fe45806d023b9fdafc7e612384987ac1bd424f07c6e9422a39e5c9977c
  • Size 45KB
  • SHA256 30c764fe45806d023b9fdafc7e612384987ac1bd424f07c6e9422a39e5c9977c
  • MD5 050c8dc5dff80e4dbdae1a46abb0bb7d
  • SHA1 44ceaf823143f92441ae6d4768fcd0b3a52900a9
  • SHA512 e842f45d44704f601db9a88db1f39f34f0e48f898508d3358028e69f24561431b35dafb97f5583b583653566b8e326bf3036e977b6d865df667c78655569f9a5
  • SSDEEP 768:MuBGJTP0BQ0UWUWHaimo2qVe0ewtDc30oiZPI/zjbcgX3irASeIMZklgmBDZEx:MuBGJTPho2twR2iW/3bzXS0S3MZkFdEx
  • TLSH
    T10A232A0037E9812BF2BE4F78A9F26245867AF6632603D5491CC451CB5713FC6DA43AEE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2