Extracted

• • Target
    c83e0e942c718b22aa3ce4702dc8e126194fb2d786aa600497623827ebe84393
  • Size 45KB
  • SHA256 c83e0e942c718b22aa3ce4702dc8e126194fb2d786aa600497623827ebe84393
  • MD5 4883f4c19032b8706407f8afc604b170
  • SHA1 118f9ed7beee6cda47b147109e2c3277af0a7cee
  • SHA512 9003ca53b022174874e4ca248badf11d8ca4a67b7b9b38f043b41152aec00d803c3cec041e6ebe50a08890812f94f54da1955a49092178ce26dff35ce9b42597
  • SSDEEP 768:cu6RaepTPYzbs8WU+Xaamo2q1OxGQGPPHuPIpzjbigl3i/gGS0t3QKGnsQ3wBDZW:cu6YepTPso2jHw3p3bFlSusQmdUx
  • TLSH
    T19D231A003BE88127F2BF4FB8A9F26145867AF6633603D5492CC452DB5613FC6DA426ED
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2