Extracted

• • Target
    286c05c1a00ea775b966e9d6a22bcba9d1cf34390c2b0a91eb1e82583235bbdd
  • Size 45KB
  • SHA256 286c05c1a00ea775b966e9d6a22bcba9d1cf34390c2b0a91eb1e82583235bbdd
  • MD5 683c9744e9ca1ec212bd7b1cbe7e9e8b
  • SHA1 9bbd14007a575e6a2842f360ad12c265f2175b71
  • SHA512 8e69a348b571008f737c7f60b753cd20cc29fc286cc140174dc912d5ca42aba1f1fb2fb991a50c81630b24f050a4dd5ad709620b8bada3b6fc46d7dac79c0deb
  • SSDEEP 768:UuKWgSJTwU6NkWUGnaSmo2qAOGsGx8OHuPI2zjbxgg3imPypNwlX4xKlo2BDZcx:UuKWgSJTwRf2eez323b+gSmKpNwEKlns
  • TLSH
    T1362319003BE8812AF2BE5FB898F26145467AF6637603DA4D2CC441DB5613FC6DA426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2