Extracted

• • Target
    837d8b19f2ca6a245cc26834fa2a8e68ce7ef1ddf3ade3179683fc62124d3c88
  • Size 45KB
  • SHA256 837d8b19f2ca6a245cc26834fa2a8e68ce7ef1ddf3ade3179683fc62124d3c88
  • MD5 7598548dd0429115fc5b87a88976091d
  • SHA1 7fe35a3f3de85a1c911c06576235c8941489fb09
  • SHA512 f836adda8cd6170a8cb1be693d9bd5917cb7c32c6de1b0bc90fae5ec82b5483c2a964caca9f65655ec422af9943031ae410518e518541a9f1334ffd4eb231946
  • SSDEEP 768:0uPrpT/LGKeWUszuAmo2q9q9YqPq3hOPIezjb+6OgX3irLEwg197jMFCBDZ8x:0uPrpT/qY2Haqq3e3bLXSrLEJw8d8x
  • TLSH
    T12D2319003BE9C12BF2BF4F7898F26105467EF5633603D6491CC452975613BC69A52AFD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2