Extracted

• • Target
    857a49e16d662f236aaa7bcff0083a34acb903045a232e5cba1f01441517a15e
  • Size 45KB
  • SHA256 857a49e16d662f236aaa7bcff0083a34acb903045a232e5cba1f01441517a15e
  • MD5 dab2614439bd0db832b269941ab49e51
  • SHA1 ecae85f0f6ffb26c8a163b0eda20dad7edac046e
  • SHA512 5b6059396cb6bab5e5b818c91c82fca2195bb0594458de5e24e384c40dbe65ee48c791605dc0be6e337be5dd0ee41976772f7dd26f4f20d73dcb8263024dd25b
  • SSDEEP 768:wuZ8pT1Uu4/cWUeT66mo2q140b3NLAteiZPImzjb7gE3i4JD/WqLOdiBDZMx:wuZ8pT1tc2y3ZhiWm3bEES4B/W+AcdMx
  • TLSH
    T195232B0037E9812BF2BE4F7859F26245867AF2632603D5491CC451DB5723FC69A43AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2