Extracted

• • Target
    c852abe3fd6923a7b63db342ee3393520ebba1a774ea31a9cf0427c5e198acf8
  • Size 45KB
  • SHA256 c852abe3fd6923a7b63db342ee3393520ebba1a774ea31a9cf0427c5e198acf8
  • MD5 33d86fbe350c3017d7d1216039984c97
  • SHA1 eaeaefbecd4ae4e66baa40aff33a308de022de1f
  • SHA512 bc43b1003277626971ae1f841f3c8d2b4121a97c53cad2bcf30c827f4743a92e3562e647b3b83b1c554e9b501d330ea82170656e1abf841509056772e73e5dc5
  • SSDEEP 768:5udApTNctooWUS7C+mo2qt0COtTMtPILzjblgX3ioo/j9hh5SgjuHBDZ0x:5udApTNmU27RvL3biXSoo/hhhsgjud0x
  • TLSH
    T15A231B0037E9812BF2BE5F78A9F26145867AF2673603D58D2CC441DB5623FC686426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2