Extracted

• • Target
    832e581ca49893b7061a57443de399e233c0bca655d02366c270911c11ecd9c4
  • Size 45KB
  • SHA256 832e581ca49893b7061a57443de399e233c0bca655d02366c270911c11ecd9c4
  • MD5 a77e55e0c8eb9d9257fcbfa304e4db96
  • SHA1 6bc85c106f96e59926532e7bc7a263a85d3cda07
  • SHA512 943608320018a4561a6aac4de0aec262ad6be8b3e2fb21e908f6625ce01e8945bbac63b70e8d22e5991b09d9454fa779f26f75331d7219c964b7323676b8c11f
  • SSDEEP 768:cu7m/5THrq+CWUoDuMmo2qFTlsHoPEaMPI10jbDgX3ims6XhuPkc/iXoBDZUx:cu7e5TH2A2muuEax1UbcXS84kOdUx
  • TLSH
    T1F9232B003BE8C22BF27E4F7899F26145857AF6637603D54E2CC441975623FC69A42AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2