Extracted

• • Target
    3220f0004a4155a8d059bdd743367cde67939dfca962c68cfac5f98b6ed0f66d
  • Size 45KB
  • SHA256 3220f0004a4155a8d059bdd743367cde67939dfca962c68cfac5f98b6ed0f66d
  • MD5 8a578e5d6ad7cf32320d9ee696ec3a8d
  • SHA1 d4356c2ba2b6eae13b1cf6e63f39f8d254d29572
  • SHA512 a2fd8565bd2a49e5d9297a61f30d5ed5e30fcb99a22691cb356eb69827e36bcfb293bad1fc3ef2442fff82eab1cf003fcd6eb2c1dccf2cdc3cfe28f6a2dd0e78
  • SSDEEP 768:FuxkJTVmU5EkWUGMKSmo2q1QhiQDBZwYqEdRPIUzjbjgX3iPvgPEETijsOJVGu8t:FuxkJTgip2XOYqEdOU3b8XSpEMs6x83d
  • TLSH
    T1EA231A0037E8822BF2BE4F7898F25245867AF6637603D5592CC442DB5713FC69B42AF9
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2