Extracted

• • Target
    833c746908c6d2cf88e2779b421a154e3ed1b4fe13bca146af7edcb3729fa706
  • Size 45KB
  • SHA256 833c746908c6d2cf88e2779b421a154e3ed1b4fe13bca146af7edcb3729fa706
  • MD5 a735f62765c09865db55d172fbdb8b19
  • SHA1 01653e927f3a139b63af6c5a9a61f058e4e3f23d
  • SHA512 50334191a8aa4dc358eeac0c7035f41f2299247e5f3c4b0934507da7d63cdbe3a858084e91eec14dfe23d75407763c55fc6ef32ecaf03f4e90a87b069070b5f9
  • SSDEEP 768:EulCJTHESwgWUK3aGmo2q9TZo3TMtPImDjbqgX3iSeE6oJ50phMjJBDZsx:EulCJTHl42sU3mnb9XSSh6oJ5oSXdsx
  • TLSH
    T13D232B0037D8C22BF2BE5F78A9F25245867AF6633603D54D2CC4419A5613FC29A42BFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2