Extracted

• • Target
    844d819e5d39a363828cb08948a7d718b586d3d0ce3ed99f5e87c1363e1a3f15
  • Size 45KB
  • SHA256 844d819e5d39a363828cb08948a7d718b586d3d0ce3ed99f5e87c1363e1a3f15
  • MD5 6668db07a1d5f77f1138c20b9b681baa
  • SHA1 bdc8fb368c2efc8db38d61a5019d57b4e6395c34
  • SHA512 a04421ecb59a865c3e8dd855404660f8fc9752e45a387e0926314dec1ff95f27ab545cad8bcb2782b6d7e48b4931eab984ff18dec054be988f11bcca29a6ad6e
  • SSDEEP 768:wuDWZTpw7bmaWUg3gSk0mo2qln9xY6aZOOPIrzjb/gs3iLCrknvsTgRG1BDZMx:wuDWZTpMZSB2Cs/O3r3bIsSRnvs0RGb8
  • TLSH
    T103232B003BE8822BF2BE4F7899F25145867AF1B77603D54E1CC4529B5613FC68A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2