Extracted

• • Target
    826a86410bbdcfea9ceb522f021c50b619f1319d910ee295a0fecb33a0d1faa8
  • Size 45KB
  • SHA256 826a86410bbdcfea9ceb522f021c50b619f1319d910ee295a0fecb33a0d1faa8
  • MD5 115bee87ec35fb14d8e06398be551ec3
  • SHA1 1e21fd36d9cb636cbca90c1b37ffb8f55f2f29f7
  • SHA512 3417b95cf762f1513b39c5bcf26fbc406d6775543632755862cf6742bed09bb13514dfe00ff44d8ae8e77dbe9be42f45c4af7db7b8fdd0db60c7fc624b34846a
  • SSDEEP 768:5uSy6pTpwrSWWUE3/WImo2qN1O5QSCBzHSNjPI7zjbEgX3iCiCh/gUFdvSUEkXBU:5uSy6pTpoo2kO59ESK73bLXSCL5bFdv8
  • TLSH
    T13F2329003BE9822BF2BE4FB8A8F26145467AF2636603D54D1CC451DB5613FC6D642AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2