Extracted

• • Target
    0826c81e9aa381581c7e3cc4ecf232f1fc06a973f4aa851a9a84ae0a4f77290f
  • Size 45KB
  • SHA256 0826c81e9aa381581c7e3cc4ecf232f1fc06a973f4aa851a9a84ae0a4f77290f
  • MD5 b1b2033db0ffee48eeafa26ed0c30795
  • SHA1 6cdf1948970e2271fb9255885e39c3dd5c711716
  • SHA512 24ab6fbdfacf586e8d4b1bf73b511341550a38d14afb6f4aa1abad421b4060eb1a87fe77d8d8427ffebe43d457c929f1ec2a9ee4ac5fd96606705cfaaa4d2d5c
  • SSDEEP 768:EufspTfzcR6uWUcb+wmo2q9wO5QSCBzHSNjPI7zjbFgX3itQNm0R8Cw058oUiBDI:EufspTf2g25O59ESK73bCXSqNN8CwBoo
  • TLSH
    T1E1232B0037E8812AF2BE4F74A8F26145467AF6637603E5892CC452DB5713FC6DA426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2