Extracted

• • Target
    328d21ac1cb41e5cbfa48df87ad18980b73e4741f56c64b00d262d649413f111
  • Size 45KB
  • SHA256 328d21ac1cb41e5cbfa48df87ad18980b73e4741f56c64b00d262d649413f111
  • MD5 0d8812a719f38a5333538f9f112405fb
  • SHA1 76475632cd2f0d7c8421675b3f42a17e3743669c
  • SHA512 2c91dfdae2d1e0c5a74b843444b6433ece3bedf9ed2f930523e857caa7a97024b6a4462ed3c969bf97f86e966a8ff2b36a38a83347b909cc449390730829fc7a
  • SSDEEP 768:8uuSpTg7GBoWUSH6+mo2qYEx1HJhOPIcozjbcgz3iIizjtNwanBwGrdU1fUBDZ0x:8uuSpTgyf20Fj3co3bzzSI0jXBwGpkfN
  • TLSH
    T194231B0037E8C22BF2BE4F789CF26145867AF6633603E55A1CC451DB5613BC69A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2