Extracted

• • Target
    2183d62baf8f05e7c004b35ba85217646567345a6c16baaf1cc0a0e1125057f8
  • Size 45KB
  • SHA256 2183d62baf8f05e7c004b35ba85217646567345a6c16baaf1cc0a0e1125057f8
  • MD5 8cc8962697af20ae6aac286b4335a250
  • SHA1 83d123f49760f7ce6bcc7c60e72c75e23b4f99d2
  • SHA512 f6fc955110a228ea59aa82945e45d0c8b9aa1b42bcc835141a6605e6e79c31e951e0617af96654a779227977c62124418a12e1cd0efd8ba391a1e650f4aa71be
  • SSDEEP 768:cu6RaepTPYzbs8WU+Xaamo2q1LT2Qpm7PIKAjb7gX3iTOLLtwIMfunqje/XcBDZW:cu6YepTPso2JeKobEXSTcwIMWnqjeSdW
  • TLSH
    T1ED231A003BE8823BF2BE5BB858F26145867AF5633603D54D2CC452DB5623FC69A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2