Extracted

• • Target
    858480b7a3a75f02e602768b65c92f9283bdd9c4497d34148dcc65505996eefb
  • Size 45KB
  • SHA256 858480b7a3a75f02e602768b65c92f9283bdd9c4497d34148dcc65505996eefb
  • MD5 f8ce82db05a98589e64f70cb2d8dce00
  • SHA1 182f480198e34225abd12e27b8e064b7e56c8bf7
  • SHA512 94ac66e5c539b0a5bf9bdc402f78bfc485d7430dc3d7bce96e22bfb01f56d1b1d788fcc8a0d47170aa60cc3a1547a70d3235a0482b5ff1fa27d93899cdc028f2
  • SSDEEP 768:cu6RaepTPYzbs8WU+Xaamo2q1nT9Qpm9PINzjbTgX3iSGyMvEgjmuxgxgw7BDZUx:cu6YepTPso2GQN3bMXSSw7CF9tdUx
  • TLSH
    T1C6230A003BE9823BF2BE4FB86CF26145867AF5632603D54D2CC451DB5623BC5CA526EE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2