Extracted

• • Target
    885fc1566f869d5ffa891b7ab76be34189bb31ff86877e67b9e44c506fa1703e
  • Size 45KB
  • SHA256 885fc1566f869d5ffa891b7ab76be34189bb31ff86877e67b9e44c506fa1703e
  • MD5 e625a6a4c6c8231fb854affc78d99bb8
  • SHA1 dabdd451bce63ec07523884a6fa07e0ca717e7c2
  • SHA512 8937794d23ed211b597f4c78d003138585401752d79e108437b4bf26496ec5c4a1e6cd94b382243607ab342c1f964f7fb6030a0d9300ee768efa84284f26d5d8
  • SSDEEP 768:wuDWZTpw7bmaWUg3gSk0mo2qlKm/9GgrOPIRzjbogX3ihT28fEY8Pm7BC4EhBDZO:wuDWZTpMZSB2Bm1b3R3b/XS086PmI/dO
  • TLSH
    T171231B003BE8822BF2BE4F78A8F26145457AF5B37603D54A1CC4529B5613FC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2