Extracted

• • Target
    f86adada7d147dd5141da99d1d3e05048218502372b8f9ef341b6839d497e054
  • Size 45KB
  • SHA256 f86adada7d147dd5141da99d1d3e05048218502372b8f9ef341b6839d497e054
  • MD5 1c711141e4845450db9e2e729aa49276
  • SHA1 331da9f41bb38e74c8e32d17ef5f83627722217e
  • SHA512 02007a3ed67e1580cf9b27d753b250fc73c2a4597ace5378f837759d9ca4a665fe62bff624ac5c63eaac1501036da45dfc7165f28f20dec6a3ee5775300a8a71
  • SSDEEP 768:wuZ8pT1Uu4/cWUeT66mo2q1opt0CCM+d4CvS8PIk+jbhgX3i2DDFCbSBDZMx:wuZ8pT1tc2x/CFWBkybOXSiMbsdMx
  • TLSH
    T12B23190037E9812BF2BE4F7859F26245867BF5633603D55A1C8441DB5B23FC68A43AFA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2