Extracted

• • Target
    85c7afe5a757b78455be892fd651cd784493842cd6c4812f75d72833330ac57c
  • Size 45KB
  • SHA256 85c7afe5a757b78455be892fd651cd784493842cd6c4812f75d72833330ac57c
  • MD5 434020bcc6cfde052a0fbf1cd77a5763
  • SHA1 52ce3ad7ef4758d434547a5812637e2cf01703a4
  • SHA512 4cd41f157036d9bf1e4f3844acca45e56c0970e17ea80b642da5e4ae4148a9bf49aada89cb19bee210dccc904bfd06e4a28801c63ba5d917c723abdb0b565462
  • SSDEEP 768:RuxkJTVmU5EkWUGMKSmo2q17bT0GYjHuPIpzjbOgXNi83EIV01LBDZcx:RuxkJTgip2Os/3p3bxX80Q1ddcx
  • TLSH
    T1B9232B003BE98227F2BE4FB899F26145867AF2637603D94D1CC451D75623FC69A026FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2