Extracted

• • Target
    329eb9931f6ad35eab96ee75df59dd5e734e160f316de1abbbd1c0070335ec93
  • Size 45KB
  • SHA256 329eb9931f6ad35eab96ee75df59dd5e734e160f316de1abbbd1c0070335ec93
  • MD5 57a424879c6d038167eb46fa29e9c0f2
  • SHA1 67acbdc9cebff5f72d090f0feed80c700f2dd7c3
  • SHA512 ed7b3ade688fd95432d981a829d34ae57692e3ed574794af1ceec8e8b8592a2392e78d7019400fe012d0b2a918948de948af77628744d77a1fe9d755586e5828
  • SSDEEP 768:cuq04JTLcsP8EWUmOTymo2qAWVlcVl6GcPI+zjbTgX3xpZ2yRR3De9uBDZUx:cuqNJTLr62mV2X6Gh+3bMXBpZ2Mze9g0
  • TLSH
    T175232B003BE9822BF2BE4FB89DF26145867AF6636603D5491CC441DB5713FC68A42AFD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2