Extracted

• • Target
    583bd02e2efb5aa981ac0199d43de2cbbf2dc13d0b959904c5f7a45e7ad75134
  • Size 45KB
  • SHA256 583bd02e2efb5aa981ac0199d43de2cbbf2dc13d0b959904c5f7a45e7ad75134
  • MD5 624fe6093fd3a822c369433fea38c02a
  • SHA1 05d0250a6b96c2b5c1b8fb0cb6b9df115b25567f
  • SHA512 d5a78b553454336763e38fdb673aa6dc5bf1505578fd95a0007e082983f7dfe5cddc0bcd40c9eab5d1dea70836646896021a94e79fb2ec50e0cd00b40ca4d294
  • SSDEEP 768:8uuSpTg7GBoWUSH6+mo2qYh6R8aI3OPIOzjbBgs3iBtVPcg9BMov/5BDZ0x:8uuSpTgyf2J+FO3O3busS50g9BMond0x
  • TLSH
    T1E8232A003BE8812BF27E4F7899F26145867AF6673603D58E1CC451DB5613FC68A42AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2