Extracted

• • Target
    589ff97e24cc356728dc979d193d659bc708248e2de392b83af73c79b1dd7c8d
  • Size 45KB
  • SHA256 589ff97e24cc356728dc979d193d659bc708248e2de392b83af73c79b1dd7c8d
  • MD5 a84c6bcf031f7903eae01fb61a58ba09
  • SHA1 253f1d238d99d483192f9a1889aacc6f5a863cff
  • SHA512 193c040cfbbfc933e38b4f938362201c5bbe0473432d7463c19a5cbef39599d7f9288e7c3818f0b2ebce1a576ebfedb178b1038cdcfdace56b41c59e22907816
  • SSDEEP 768:wuZ8pT1Uu4/cWUeT66mo2q11H0CnrARPn88PIN+jbzgX3ipB8aJjCzSQBDZMx:wuZ8pT1tc2Mfn0+BNybsXSLFCHdMx
  • TLSH
    T167231A003BE8812BF6BE5B74A9F25145467BF1632603D54A1CC441DB5723FC6DA43AEE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2