Extracted

• • Target
    31b9f93e670ba01349c0d2e418eea27c3afc1c1c74304e952a93ce4e6b11e299
  • Size 45KB
  • SHA256 31b9f93e670ba01349c0d2e418eea27c3afc1c1c74304e952a93ce4e6b11e299
  • MD5 12aa0233a9f96222326ae0f8b45c5998
  • SHA1 acf3ec23d914cab16aefc1bc01ae207cb39b09ee
  • SHA512 4d5d4ce2bcfc9d268dc4d8a51f6bd9fecd387a21901dca7762db460cf94cea211017a3b898cf324fc9e2dedfeb89e78658be19c9f0f88ee931882dcfbb38ed82
  • SSDEEP 768:EufspTfzcR6uWUcb+wmo2q98zjHynaKPIsIjbbgX3i0d8U860gfpLOBDZsx:EufspTf2g23nZsgbkXS0d8a0upsdsx
  • TLSH
    T1AD232A0037E9C12BF2BE5F7899F26145867AF6633A03D6491CC0119B5623BC6CA526FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2