Extracted

• • Target
    89ead16f11390a6cf688d753a22a1100d1ec989ceb943e962dcf7aa4796f8fcc
  • Size 45KB
  • SHA256 89ead16f11390a6cf688d753a22a1100d1ec989ceb943e962dcf7aa4796f8fcc
  • MD5 e071c026f371c624c09f93143184b4f9
  • SHA1 7d8e7972cc868412550652469b774f4b9e725094
  • SHA512 3e50c3cb3b59a3adb312a46115cd9f2e308d69948791cf2b764f4c5efb67c3cb41522a6ae372ad1d5db45d84aa10a88c0dce722cc22f8c32607239b373a6203e
  • SSDEEP 768:8uUIpT4vvofWWUEXb+Imo2q4j9Yq3q3hOPI2zjbAgX3iI+AkGCgok5BDZ0x:8uUIpT4vAj2naCq323bnXSIR5Cynd0x
  • TLSH
    T1A4232B003BE9C12BF2BE4F789CF26145867AB2633603D6891CC451DB5613FC69A526FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2