Extracted

• • Target
    83e4597b662f7d04af42d53d0af99ac4977a4f832839ad578091bc1b60f1c4e5
  • Size 45KB
  • SHA256 83e4597b662f7d04af42d53d0af99ac4977a4f832839ad578091bc1b60f1c4e5
  • MD5 e7d4208f9642f5af907e30627a478dfc
  • SHA1 2d9c0a2a89adceec98446412e9df46aed0ccaa65
  • SHA512 ff9ce014240370c5252d19c2ed62da3efd3aa34b26b2ab182eaa7bf44d6c92b03a323c61f6ae79db441126ada4e47b0bbeac54b66e94997e998507566d00af99
  • SSDEEP 768:cuR0JTPUYkEWUmjWymo2q1nfkLyuObvtkjZPIuzjbRgXwi3i9hm5Ywtlizq4BDZW:cuR0JTPjY2OfLuyyjWu3beXNy9Xzq+dW
  • TLSH
    T1A3232A003BE9812BF2BE4F7898F26245867AF6736603D54D1CC452DB5613FC68A42AFD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2