Extracted

• • Target
    8103b32305a33fcb126ab520e05c242ed9fe758179e750d8ace8134a0cdfc59b
  • Size 45KB
  • SHA256 8103b32305a33fcb126ab520e05c242ed9fe758179e750d8ace8134a0cdfc59b
  • MD5 6f732e8cab14e22a701a5f32fdd68ed5
  • SHA1 7f0d55daea0a70f5bc43ff3626f52851a43a36ae
  • SHA512 6f0a505960a4c9d677a06ba0846eafb5d37ddc10f8ae2b4ca8c853733714766a27809a79e7ace771767d501f683d6be58886470e49a5e4ce87eda78b8f4078ea
  • SSDEEP 768:cu6RaepTPYzbs8WU+Xaamo2q1LT2Qpm7PIK+jbtgX3iXRI7TH7ovZSWh9Au74BDg:cu6YepTPso2JeKyb6XSXRI7bcvMgaFdW
  • TLSH
    T125231B003BE9823BF2BE4FB8A8F26145867AF6633603D5492CC452D75613FC5DA426F9
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2