Extracted

• • Target
    b32ed0ddae0f3cc5828029b622043c48251403d69973384e26686ff486d3695a
  • Size 45KB
  • SHA256 b32ed0ddae0f3cc5828029b622043c48251403d69973384e26686ff486d3695a
  • MD5 c0ddf602bcfeaaa462c97267233e0a16
  • SHA1 2e6f375e669fbf08de23d4e138cd8f390950541a
  • SHA512 e194c4cfc4ba278a28a27141678433fb8f89676b391c6163834eb3c1eda0259c27318c5df514fa0576dee67b868824ca1aa1d1489544d6157a90beb8b902d980
  • SSDEEP 768:EulCJTHESwgWUK3aGmo2q9hCHyTtUPI3zjbxgX3inAro5xGmTaLu2BDZsx:EulCJTHl422nj33b+XSgmTEuYdsx
  • TLSH
    T18B232C0037E8C12BF2BE4F78A9F26145867AF6637603D54D2CC4119A5623FC69A427FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2