Extracted

• • Target
    89fce38112026956e64b0e241d28442aa1ba90bfd378fa0192ec347462647744
  • Size 45KB
  • SHA256 89fce38112026956e64b0e241d28442aa1ba90bfd378fa0192ec347462647744
  • MD5 060253c1dfea7bec6f28c965b8ffbedb
  • SHA1 f1771f325255cfb89b7e2f27abd19327c349a45b
  • SHA512 c706b3a96bee68f3ab7c36d03171ea25c2fdec534aadfb29f7bf9a7d59200ef1f16b12d00c3700a9d1a94aba8bd31dd5f49ebd45f1573dfcd39d0342c0299848
  • SSDEEP 768:4uLZZTUAoOSWUYZL8mo2qFf9xY6aZOOPIrzjbGgt3iY3fahmvCtDeBDZbx:4uLZZTUTn2Ks/O3r3bZtSY3qwdbx
  • TLSH
    T12E232B003BE8812BF2BE4F78A8F26245467AF5B73603E54D1CC4519B5713BC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2