Extracted

• • Target
    856f882bd7b0d2fa2aa7e052d36ca10a39c4e9ccff849c8aa5770ffc483a1791
  • Size 45KB
  • SHA256 856f882bd7b0d2fa2aa7e052d36ca10a39c4e9ccff849c8aa5770ffc483a1791
  • MD5 29d36c132677230bb726345f35078a38
  • SHA1 71c67d790fe42f5cf750e3ddffb2ba1619236ef8
  • SHA512 74df98c6f0fc6689e89bda3fe78ee3183796d02d38fbd6c6ca8af66c5f25e4f1168189dbe85e6897ad288f5176eb94e3b31bce6de1d19cbdc7b4f7bc763b9ffc
  • SSDEEP 768:EufspTfzcR6uWUcb+wmo2q9Ewz/y3qiPIXzjbegX3ihbm5KbtBEA7pBDZsx:EufspTf2g2v0hX3bhXShBtBH3dsx
  • TLSH
    T19B233B0037E9C12BF2BE5F78ADF26145467AB6632A03D54E1CC4119B5723FC58A42AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2