Extracted

• • Target
    235ac6cbd4b00615ab3d03d1ef36f66df9a5fa089aef4ccb5ae9881572545631
  • Size 45KB
  • SHA256 235ac6cbd4b00615ab3d03d1ef36f66df9a5fa089aef4ccb5ae9881572545631
  • MD5 e34f109a0a8d6352d74d575a2484d219
  • SHA1 ec3e02f6bbc074e93f3b5b8a21cac4ac9f480fbb
  • SHA512 246d99609ca456e9b586bc1b83a4009a98e5777444d91449935ae753e2df817d44045ae7522bd837c258a8f6796ee9cf69c441a5e4a17e2b69e9e26d35404afa
  • SSDEEP 768:wuDWZTpw7bmaWUg3gSk0mo2ql43Fo9EaOPIxzjbIgX3iL6jG1jXygAMaBDZMx:wuDWZTpMZSB2J8Ea3x3bfXSL6jwygAMn
  • TLSH
    T1A9232B003BE88227F2BE5F78ACF26105857AF5B36603D5492CC451DB5613BC69A426FA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2