Extracted

• • Target
    848d37d4bc5527e7958cc1bfbb4791d96d439ed89a4195e32bd0551e6d21be51
  • Size 45KB
  • SHA256 848d37d4bc5527e7958cc1bfbb4791d96d439ed89a4195e32bd0551e6d21be51
  • MD5 3a20bffd41ce0c2906b5c172a109db87
  • SHA1 e04757c08c4a4af6d79e3f4d0cfe5543fc6b1acf
  • SHA512 ce3ba815e197718c201839e8c768e85f58356f268461f534d5df51faf03b609594200caff7640033f9e24f59fe8fc06aa98088ae03cf5b02c0ce87c70bd44b60
  • SSDEEP 768:MuBGJTP0BQ0UWUWHaimo2qVyLiE0yFjrdj3kk8PIhKjbrgX3it9e4llO3EcaqzRN:MuBGJTPho2/LBXDBhGbUXStQ4lDcZRxV
  • TLSH
    T193232B0037E9812BF6BE4F7869F26145867AF6732603D54E1C8451DB1B23BC6CA426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2