Extracted

• • Target
    39e6e0dfef48f4d3d645e1a72b744f614992888d8df24e0d988699b197a1838b
  • Size 45KB
  • SHA256 39e6e0dfef48f4d3d645e1a72b744f614992888d8df24e0d988699b197a1838b
  • MD5 07d8248c3e142f34f15bfd54257a0d6a
  • SHA1 2dbe3c0abf67847deeff67473a6251a2ce85b1dd
  • SHA512 fdaa6e904ed771037525694c31e3e68c13f88837a3621e49ed31ee6547303b7a93d8f4d93fa62657acf21a787b4a72ef530a73f4f72fd97f3cdf8f0ed7cce8c5
  • SSDEEP 768:cuR0JTPUYkEWUmjWymo2q1fLiE02FjMdjYkkmPIDzjbJgX3inRirGjZiWcBDZUx:cuR0JTPjY2SL9wQPD3bGXS5jZ76dUx
  • TLSH
    T1E5231A0037E8812BF2BE4B7869F26145867AF6632603D68E1CC451DB5723FC59A436EE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2