Extracted

• • Target
    b483a59d79c924a008ca992eab9525f8059759a7729711f4482a77c5336de7a8
  • Size 45KB
  • SHA256 b483a59d79c924a008ca992eab9525f8059759a7729711f4482a77c5336de7a8
  • MD5 7bddc155509cf3372ffd1393973be4d1
  • SHA1 8dc31104d105fa6e67a04cb7dea7c228809efd98
  • SHA512 e4f112c90d998cc22018be2ca86805df50d3f93e2298583729f438d69b31f5f421221be8e77b2adb4296c4144c87b6013fc8547aece4a271372a02ba091ebb6b
  • SSDEEP 768:wuZ8pT1Uu4/cWUeT66mo2q1opt0CCM+d4CvS8PIkQjbDgX3iJ98tXLaBlkEzBFB8:wuZ8pT1tc2x/CFWBkYbcXSw9WBqqLdMx
  • TLSH
    T1A0232B0037E9822BF5BE4B7868F26145867AF5633603D5491CC452DB5B23FC68A43AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2