Extracted

• • Target
    c32589df8cacf3c9f160d7edf3f3dd552290d1ef9053f6fb60d833a77aea92a9
  • Size 45KB
  • SHA256 c32589df8cacf3c9f160d7edf3f3dd552290d1ef9053f6fb60d833a77aea92a9
  • MD5 e19688306cc57896d211a2bd577369f5
  • SHA1 5987eb75a89e1e74b982acf8641f65fd2a584a4c
  • SHA512 a37f4ac38fff24829dd28c1c39e02d01ba0d58542fe2e73ff933b35c6c4f6e8caaa69ceb41963428d7d94fb8f19ae64cef2ebb46fede0e15cf3ee30c317e5941
  • SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qF63xq6YFoOPIUzjbJgw3iKVsTFhiHtU3+KClBDZEx:MuLAZTnbg2Pkxo3U3bGwSATHtrdEx
  • TLSH
    T1C22329003BE8822BF2BE4F78A8F26145467AF6637603D64D1CC4519B4B13FC696526FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2