Extracted

• • Target
    808206a4c4b42a13510aee4b57b5328344ec357300705a5635d5a8495b17efe3
  • Size 45KB
  • SHA256 808206a4c4b42a13510aee4b57b5328344ec357300705a5635d5a8495b17efe3
  • MD5 98c88334ad34cdce153ccfaa8f17e08a
  • SHA1 ce11cc926e73e6dac3f9a4a24634ebe2533b1500
  • SHA512 c17adc0c4f249bfd1a02b214b0e5176ae81b44293baad654f73652cf450461c527e0c01caaf2584e52627e5fd5d43d338262a1ae7eb53315d9c909f22f011822
  • SSDEEP 768:0uPrpT/LGKeWUszuAmo2q9Xozfy3CKPI0qjbPgX3i0Zzntv3lM0C8FBDZ8x:0uPrpT/qY2ZTR0mb4XS0Zc0C8Ld8x
  • TLSH
    T18D233B003BE9C12BF2BE5F789DF26105867AF5633A03D54D1CC4129B5613FC69A42AEE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2