Extracted

• • Target
    87a43eee6939ce55cf60ee10315daa061a669754ba50cd45ab0f491270bbae92
  • Size 45KB
  • SHA256 87a43eee6939ce55cf60ee10315daa061a669754ba50cd45ab0f491270bbae92
  • MD5 a71d412627eae2a2c442df35be529b62
  • SHA1 0dd0d06959f518d93d3df878aca23ea7f22d4051
  • SHA512 f89779a085f953199964e03ce169272107aeb6617e6593437f5a0ed7af6e2690a60c24674f3603e7aaaac04670b0ccc82a1c050c180a376b29e4adabe3c8bb29
  • SSDEEP 768:cu6RaepTPYzbs8WU+Xaamo2q1exGQG9PHuPIczjbDge3i2rcN2L3AwlK39hBDZUx:cu6YepTPso27HC3c3bceSsrbAwS9fdUx
  • TLSH
    T1FC231A003BE9822BF2BF4F7869F26145467AF6636603D64D2CC441DB5613FC68A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2