Extracted

• • Target
    848a02ba598e69d50d2fe4a9388e8e1b7e1e1f9f3babb2ed6325da73dc796c41
  • Size 45KB
  • SHA256 848a02ba598e69d50d2fe4a9388e8e1b7e1e1f9f3babb2ed6325da73dc796c41
  • MD5 6918a71bf5cbe47ce4d38f2972bd915c
  • SHA1 82ef1911700679596a790a5dc947607044c0a6e4
  • SHA512 696a15b6af4df21dfb15e86e3010d400a0a1e59421c9bbe8ec9e01f67aea1138638a697cb93cacedcf5aee278b087c46a03322c87c6232e96b082a4355e60446
  • SSDEEP 768:suJdpTP3tcsWUODmqmo2qVMw0QbKXPIPzjb1gX3ijAeD6GMUBDZkx:suJdpTPdI2R8P3bSXSkeD6ridkx
  • TLSH
    T13A231A003BE8823AF2BE4FB898F26145467BF5632603D5492CC452DB5623BC69A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2