Extracted

• • Target
    f58ed2583dfe795fcc029422f5dbb65d90ce61bc74d949ea6b89c2bc3ef2d6c9
  • Size 45KB
  • SHA256 f58ed2583dfe795fcc029422f5dbb65d90ce61bc74d949ea6b89c2bc3ef2d6c9
  • MD5 18b72986e6b5eed45c9d958aafc412e4
  • SHA1 bba7e15bb96d6b9ef8c7238b10086eb8aefa066f
  • SHA512 db17719fec732a4f1e788ec70fd84ab35e66ccc92298a70b3122f5979ef2fc1904032f412f04c5b99fae598eb4f8fe56fe553dca5c77e34255fe4dfd53c6b1e1
  • SSDEEP 768:cuR0JTPUYkEWUmjWymo2q1pQ0u3+/vPPjZPIvzjbegH3i746qJXqPsjhZnqscBDg:cuR0JTPjY2Gi32/jWv3bhHS86qwUL6dW
  • TLSH
    T127232B0037E9812BF2BE4F7898F25245867AF6633603E54A1CC451DB5713FC69A43AEE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2