Extracted

• • Target
    32b339bd0d184ab8cf3c451985e032f5ceb0dcbe1ce20685e46e1b2ce1d9b0ea
  • Size 45KB
  • SHA256 32b339bd0d184ab8cf3c451985e032f5ceb0dcbe1ce20685e46e1b2ce1d9b0ea
  • MD5 e7613148de67ad79cf7a48666791c630
  • SHA1 03ef8f53994090f39507058e5815f19ec26180da
  • SHA512 0dc60cd6d2e50a564bb64a378a6ef8d08fdb0fca8b235a0c50a7a7607b74823717f0bfc7cc96da75f088b272fc11b26a9abf324e9179cceaa23c5ca6662d57a1
  • SSDEEP 768:YuJdpTP3tcsWUODmqmo2qVX0UwPOlehAPITpzjbdgX3i0jV6urKsBDZYx:YuJdpTPdI2u0/OghlTp3bKXS056QrdYx
  • TLSH
    T1A6232A003BE8813BF2BE4F7899F26145467AF6677603D64A1CC451DB1723FC68A426ED
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2