Extracted

• • Target
    81f4d1c747f527b9c0bafd62447bacd93bfc89d308227a0330085778a7decc83
  • Size 45KB
  • SHA256 81f4d1c747f527b9c0bafd62447bacd93bfc89d308227a0330085778a7decc83
  • MD5 57f0f84c6748ebdd1d79085dbe2be7a8
  • SHA1 68c5816ec9b1ba6e3166a68f67014f15f1b1b463
  • SHA512 98f6dc44ef9be9cfbdcc587501f60866a520281b5bd518e39bff7a002fdd1858676ea35fbf830572a49fa47f41bf048b0b720870243f38466be7638bd20a9026
  • SSDEEP 768:0uPrpT/LGKeWUszuAmo2q9y9Y6kq/zNOPIyzjbagR3iUhkl2mbBe8JCHiBDZ8x:0uPrpT/qY2va9C3y3bNRSUSlR7d8x
  • TLSH
    T19F233B003BE8C12BF2BE5F7899F26145867AF5633603D64A1CC411DB5623FC68A526FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2