Extracted

• • Target
    806e96463dc2cbd8de745f328ca00ec632924bd5afbe7137db7d0e2f37b8308a
  • Size 45KB
  • SHA256 806e96463dc2cbd8de745f328ca00ec632924bd5afbe7137db7d0e2f37b8308a
  • MD5 97e6b063497f1326d70f3b71b145b127
  • SHA1 3b0cc2b8243fc78f07f29c2a4954e8ad0ce0467f
  • SHA512 5157f0e54e4102041d81c64c220868ab9ad0b1f8c57007595a83a386d69dec9bedb7a19cdf291dce893eb5685bf97511a55db01549083e181bd775e2856ddefd
  • SSDEEP 768:0uAVhJTDEQAQWUaDyzWmo2q7jZoyTM4PIX4jbHgX3iGjDzwPBDZ8x:0ushJTDXgH26h0XwbAXSUzw5d8x
  • TLSH
    T130232C003BE8812BF2BE4F78A9F26245867AF6633603D54D1C8441DB5723FC69A526FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2