Extracted

• • Target
    838b2ebe6c7edf31f2441c1dc0e323335ffdf3c614807b5e98c64e30f23700b6
  • Size 45KB
  • SHA256 838b2ebe6c7edf31f2441c1dc0e323335ffdf3c614807b5e98c64e30f23700b6
  • MD5 a5df00875d337069213aa03f23dcf5a7
  • SHA1 5788d6e1ea801253793c9edcde1639d6ce690093
  • SHA512 2ee258fda6b395c3b76a99bd11a6fdee7b6779e8549920e4066b9fa996b1939e209d7624a0e924ccf936b02dd96569f613cd66fb75b1fde5eeaea3d6ee76a0bd
  • SSDEEP 768:cuR0JTPUYkEWUmjWymo2q1fLiE02FjMdjYkkmPIqzjbkgX3iFRppkTsaPo9KBDZW:cuR0JTPjY2SL9wQPq3brXSzkoUdUx
  • TLSH
    T147231A003BE9812BF2BE4B7859F22145867BF5633603D68E1CC451DB5723BC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2