Extracted

• • Target
    de31b0a2d0d495d7473e117259e6790c6d5b04e8d0771e4ea78bd2f014aa7f2e
  • Size 45KB
  • SHA256 de31b0a2d0d495d7473e117259e6790c6d5b04e8d0771e4ea78bd2f014aa7f2e
  • MD5 14ff6f00a45b9626492868816c9c57aa
  • SHA1 8810d4b36b1ecf82f7c75019f1c9d15397016959
  • SHA512 9c493db74de032e249adcbfa2b3058606c80386dafccb20e7217572e0a2388213d31affd345c9ec2e7b4880ddaba002d104e810f79b3e9053d3024f5efabaf75
  • SSDEEP 768:cu7m/5THrq+CWUoDuMmo2qFVls/cPEaRPIxXjbIgX3igXbbsp56lSXXPqqz3FCjY:cu7e5TH2A2U+aEaOxzbfXSQbbsp56uV7
  • TLSH
    T1DB232A003BEC822BF2BE9F789DF26105467AF6A32603D54D1CC452975713FC69A426FA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2