Extracted

• • Target
    88a8593aca95e85597e47a9a02d0359f4ffa8ec671c4804345fa64741bc2df97
  • Size 45KB
  • SHA256 88a8593aca95e85597e47a9a02d0359f4ffa8ec671c4804345fa64741bc2df97
  • MD5 599449bc7203057539e3128754fa4551
  • SHA1 8fd959ee8a7782cd748a7345ac6482655694efe2
  • SHA512 f9d17387c38a1693fed4436e2a388732ee3da0e057a1d055d25ea30b7c9b88ca4dcb930e43e5b40ac230b1f03d4c6735cbc30e7a5759d4c60d182bc2e4c24498
  • SSDEEP 768:4uBfJTMUyYUWUWBDimo2qVvL5P02FUFdxYkk8PIJzjb7gX3iGjdnhggxBDZbx:4uBfJTMpv2CLDmWBJ3bEXSGxfPdbx
  • TLSH
    T177232B0037E8812BF2BE4F78A9F26245467AF6636603D94D1CC451DB5723BC68643AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2