Extracted

• • Target
    87854497e1697121c765bcb548bb56f2e7a1a06668787288371474c362cc8a8e
  • Size 45KB
  • SHA256 87854497e1697121c765bcb548bb56f2e7a1a06668787288371474c362cc8a8e
  • MD5 d06f862c375674cd83b61fb567b51162
  • SHA1 a24a1275d381cc05da15d1bf2a40a960c52b87b9
  • SHA512 ccfffbf6fd1b050b797e1d18e10de0edfd527a48becadc508c2e10815172a0c04c25f459e1393d9da4b3def6c4fd3bbc61e353c5dbca310f6e40c8f4db4e8646
  • SSDEEP 768:4uLZZTUAoOSWUYZL8mo2qFL3xq6YFoOPIUzjbogP3il2MCa2xCPcBDZbx:4uLZZTUTn2ekxo3U3b/PSI3dbx
  • TLSH
    T1F5232B003BE9822BF2BE4F7899F26145467AF6633603D64D1CC452DB4723FC69A426F9
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2