Extracted

• • Target
    87e3819fd259be3620160a943440ee2c2db359e0e31e323236bdc8573b31a28d
  • Size 45KB
  • SHA256 87e3819fd259be3620160a943440ee2c2db359e0e31e323236bdc8573b31a28d
  • MD5 1e84e96b10f21534bbcc9826b6351a93
  • SHA1 bb84866e65e689e7716daae4a0478d48d9ca8be2
  • SHA512 3351d2c113768175b460a30bddaa01d00567b3a02597281dc5b9c0f6e227c70e3ac7d098e2b761ea725c313b03af38a08fee670b3eb8a3b880520f6a0bcbab14
  • SSDEEP 768:EufspTfzcR6uWUcb+wmo2q98wD/y/aqPIFzjb6gX3iSNlQ2CzKZq8mBDZsx:EufspTf2g23khF3btXSSIC08odsx
  • TLSH
    T1B6233B0037E8C12BF2BE4F789DF26145867AB6732A03D68D1CC4119B5613FC69A526FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2