Extracted

• • Target
    582753b0e616357e6d40d54d6c597d2633aa78cdb99533e43c7722fe30bebecb
  • Size 45KB
  • SHA256 582753b0e616357e6d40d54d6c597d2633aa78cdb99533e43c7722fe30bebecb
  • MD5 f2c6a795e042facca9ad7f82024f71a7
  • SHA1 9fa7503a5160cb64565284791e2a14358b13c9b6
  • SHA512 110b089177e993acce5a5756a424a470c3a41ff7240d55f18612829a0d7481bc65183c9233e1cff76ac727588ee16babc3de3a171bcf025e45c9ff62446443a1
  • SSDEEP 768:RuxkJTVmU5EkWUGMKSmo2q1gpMbVO8tPIEzfbegX3iQcdm1C+eSZJA0BDZcx:RuxkJTgip2dqEEbbhXSlm0+equCdcx
  • TLSH
    T123232A003BE8822BF2BE4FB89CF25145867AF1637603D6491CC452DB5723BC696426FA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2