Extracted

• • Target
    080859400684622b94ff99dd07613d5886dcccc3180ca94bf3bcc0c22523fb42
  • Size 45KB
  • SHA256 080859400684622b94ff99dd07613d5886dcccc3180ca94bf3bcc0c22523fb42
  • MD5 7dc6c744c8d88848a790a40d82c03653
  • SHA1 8b7d50852c6e287888ee53766c4ab502bb090f37
  • SHA512 3a5d8e01ba1e92d0dffb66f2f9cb42c21ca7d047f9e2e9c87c3ed561aa9c8aaa53519db217198f1ec40ca4d5d294395922903da6e99c6c3f311d6d46804a4969
  • SSDEEP 768:MuBGJTP0BQ0UWUWHaimo2qViqyx0OFUwdrxIkDPItzjb/gX3iXE6KFBDZEx:MuBGJTPho2fqKTNMt3bIXSgdEx
  • TLSH
    T1BC232B003BE9812BF2BE5B7459F26245867AF6633603D54E1CC441DB5B23BC68A43AFD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2