Extracted

• • Target
    d86af0064ed6b0725928e84e650aac7d25149dbccfac9ff3e2c36acebdff3ebf
  • Size 45KB
  • SHA256 d86af0064ed6b0725928e84e650aac7d25149dbccfac9ff3e2c36acebdff3ebf
  • MD5 229c0b3572952b8fe24d14320335aa44
  • SHA1 4ee2d138f574220f9d430d36ed4f7b4cf995c3af
  • SHA512 88b111c4fc8528991dc06f806e2a0b10ac2229dd065ca02f61d288d477b72645e37cb80874db9618c04e5a1a629e58b7f2b23b134c59fd3114810e3e62096a52
  • SSDEEP 768:0uPrpT/LGKeWUszuAmo2q93QzPivMPIFEjb1gX3iGpIdP1/F0sGBDZ8x:0uPrpT/qY2xzMFEbSXS+IdP1qsId8x
  • TLSH
    T1EE232A0037E8C12BF2BE5F7899F26145467AF6633A03D64E1CC4519B5613FC68A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2