Extracted

• • Target
    985b25c1cb11cfe259c2d8cd31e78d1f936a6451f9897c64209bd883fbbbd6f3
  • Size 45KB
  • SHA256 985b25c1cb11cfe259c2d8cd31e78d1f936a6451f9897c64209bd883fbbbd6f3
  • MD5 c2d955a292c56fd7a7750c0a2d032bdd
  • SHA1 0452ce4aa4a0d33bdab88b271ebc245aa6f2ce8c
  • SHA512 ce8e862752ce591a38ed4a559670915401f8c30c8fc154351f8257dacc1f3f73dd16430541a3af0b900764d6cca492ff9bd0a150a9ba283c785c0ca5e747338c
  • SSDEEP 768:AuAVhJTDEQAQWUaDyzWmo2q7xGFZQjB4PIFfzjbdgX3iDJMc6qj8/AYGi03BDZQx:AushJTDXgH2TqF9Ff3bKXSDJ0qj8/9G6
  • TLSH
    T1F2230B003BE8813BF27E4F78A9F26145867AF6733603D94A1CC451D75623FC59A42AEE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2