Extracted

• • Target
    82fae64647f1252df8ee84bccc0cf7997465ac3d05e31e88ae88f60fd7bea48f
  • Size 45KB
  • SHA256 82fae64647f1252df8ee84bccc0cf7997465ac3d05e31e88ae88f60fd7bea48f
  • MD5 8da49a84e037a9c1e09cf43d42662c35
  • SHA1 24e20332eb1b84bc578336ee8f5a976ddc03f1f1
  • SHA512 ae4ad76e875533ae48f5c642c22af91dde65fcc514194f5413af80a06490285987eca99e7599b7a8b32ae4dee1d77420f1ab8586e9398108937c3812e285dea9
  • SSDEEP 768:5uSy6pTpwrSWWUE3/WImo2qNvozfy3CKPI0wjbFgX3iky/yR7PLDceBDZ0x:5uSy6pTpoo2xTR04bCXSk4yRDLDcwd0x
  • TLSH
    T10C232A003BE8C12BF2BE4F789DF26145867AB6632603D58A1CC451DB5B13FC68A526FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2