Extracted

• • Target
    082799339f1f0b89ce8fb5897708c06ec5417877772a0e36b580114e2f2ba73f
  • Size 45KB
  • SHA256 082799339f1f0b89ce8fb5897708c06ec5417877772a0e36b580114e2f2ba73f
  • MD5 b06a7cec3a7a2963e5a8d3e3fed00ea1
  • SHA1 f50d1794c1aa7cce6329b03c541b7a0c2e00ad6f
  • SHA512 357df164dad3eb6a94444b5fc2474757eee40df65a4317734ae70ef2007e6eea9d98ff5b0f3c30794dda83354edbcd38bb4167b356ec72f376fb9d7451ea7e20
  • SSDEEP 768:8uuSpTg7GBoWUSH6+mo2qYNCXtTtoPIqzjbUgX3iB2bxgWKYUbHNlzPmnv2qBDZ2:8uuSpTgyf2lw3q3b7XSBQgWobDW20d0x
  • TLSH
    T10C2319003BE8822BF2BE4F78A9F25145867AF5633603D54D1CC4519B5723FC69A42AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2