Extracted

• • Target
    523bf8f3b85faf47c7ca52b224b26eee26917e7a28fde6c1bb68e81a32f93ee4
  • Size 45KB
  • SHA256 523bf8f3b85faf47c7ca52b224b26eee26917e7a28fde6c1bb68e81a32f93ee4
  • MD5 8c2a10206aee5347c43ca2fdc955cfde
  • SHA1 3323565acd85c9988dfa05976bf616a8326b5d8a
  • SHA512 66fd45b2e7939ecea68d4524a4edf3eda38927f31986b0e0e55d41c38cb49d8736a9ff6792919f91eb15013305f3f3598f79702ae4bb1eb8011ceb3582a3fa03
  • SSDEEP 768:MuBGJTP0BQ0UWUWHaimo2qVyLiE02FjMdjYkkmPI2zjbogX3iyTa6/SBh/7dmA5m:MuBGJTPho2/L9wQP23b/XSyTfKh/oAnE
  • TLSH
    T1C3232A0037ED812BF2BE4F74A9F26105867AF6736503D64A1CC451DB5623FC68A42AEE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2