Extracted

• • Target
    31803390c6fded6050498a306be14a9705af2d7319806c9dc15bcae8db29dbc7
  • Size 45KB
  • SHA256 31803390c6fded6050498a306be14a9705af2d7319806c9dc15bcae8db29dbc7
  • MD5 6730e532924d2519d67455690a2f1fc3
  • SHA1 164ee04b384f4abc0847b8977deeea9a98418a0c
  • SHA512 0b4d554e98aa27f5d30ca02529a6998e1b98bcfc4c85c8692be51f2c6add376a1142033be65f4ab36cba26246d8a8fb77ab82795c3c1816a5cbc12808008a844
  • SSDEEP 768:wuDWZTpw7bmaWUg3gSk0mo2qlN7lt440WMOPI0szjbngXeibAEW+ICVnkBDZMx:wuDWZTpMZSB2ogUM30s3bgXnbAEW+ICv
  • TLSH
    T1732319003BE9812BF2BE4BB8A8F26245867AF5733603E54A1CC451D75713FC69A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2