Extracted

• • Target
    8352fa078f55c30de843b1b231e8df55346a398c24dc12c10933f48d6597791a
  • Size 45KB
  • SHA256 8352fa078f55c30de843b1b231e8df55346a398c24dc12c10933f48d6597791a
  • MD5 f86a13bf75c42a51b5b2da9af9c6b448
  • SHA1 73ab388766df67b7264e0a31deb91642cc068abb
  • SHA512 9337bb452ad8c428b976502167c6473a0690679a7b728d6cbd57d329f07547d7bd292da31e68357881b9b45f4c380ed9049162919c22d1546bf9a2e9cde35856
  • SSDEEP 768:0u1YJTHwAUgQWUaT2Wmo2q9zx1HJhOPIcozjbCg53iFppblZqnxxoS93rNM/IBD4:0u1YJTHcw2EFj3co3bl5SFLI4S12ud8x
  • TLSH
    T1B2232C1037E8822BF2BE4F7498F26145467AF6633603D58E1CC452DB5613FC69A42AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2