Extracted

• • Target
    33ddd00d0fadb3133f1153a952442924f7bcf4551eb5185b4e2b755df577625a
  • Size 45KB
  • SHA256 33ddd00d0fadb3133f1153a952442924f7bcf4551eb5185b4e2b755df577625a
  • MD5 f24642ce9318c98e7a0f99edfffe47f1
  • SHA1 9a7f64c17f52de9b2b90e405e8e5699e83c3b73c
  • SHA512 99d02bfb237a4fb8fb348d5376412e8575528f8ec627c1ea07e6706c83e9775243f4d0d240cd5bde4b08e36a8e9136e660eeaef3921ce02f262eb2d59f5b2322
  • SSDEEP 768:suJdpTP3tcsWUODmqmo2qVOT9Qpm9PILzjbFgX3iiDVo3e86AzKBDZkx:suJdpTPdI2ZQL3bCXSiRoeAzUdkx
  • TLSH
    T162231B103BE8813BF2BE4F789CF26145867AF6636603D54A2CC452D75623FC6CA426E9
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2