Extracted

• • Target
    33ae3eb2568e5efab6ff4e14c92722ca47bf2150a7fc19b255cb9c86594601b2
  • Size 45KB
  • SHA256 33ae3eb2568e5efab6ff4e14c92722ca47bf2150a7fc19b255cb9c86594601b2
  • MD5 dcc10a5ed0dc0f932659b281ad1bcc80
  • SHA1 3149fefed50e9b524370c01d00d3a2fbbd3f38c3
  • SHA512 ece5591c27ed68306971e66f58d04da12106be8bce7fe5ec9ac30e84aeffe1ebc4afcdcea85414300d7bc33e0a421973929f7a783bddc2030533917a4546c3ae
  • SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFEfBohEa+PIvmjbrgX3ifOkPTmiatb2NBDZEx:MuLAZTnbg2Z4EaHvKbUXSfd7CadEx
  • TLSH
    T173231A003BE8822BF2BE5FB8A8F26145867AF5637603D64E1CC451D74613FC696426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2