Extracted

• • Target
    87e2e1ff646b8609ae287dcd12b27e6d70fa287fe0711013c74f0fc7d978882c
  • Size 45KB
  • SHA256 87e2e1ff646b8609ae287dcd12b27e6d70fa287fe0711013c74f0fc7d978882c
  • MD5 be43eef755679bc0a3c91993a794f7ac
  • SHA1 1ad5e84e6e3ab8d80b017ce83bf2cca73013652b
  • SHA512 60e618f2eb3f50bb5323e647121fba6dab7b08ce0155f217e93f906aa26306420666f9935ed111ac0ade9454539c85e628b977532f482485cb7a46249ae57d64
  • SSDEEP 768:wuDWZTpw7bmaWUg3gSk0mo2qlI3Xo5EayPIVzjbsgX3iOlKWHGy0BDZMx:wuDWZTpMZSB2jQEabV3bjXSkHG/dMx
  • TLSH
    T156233B003FE8822BF2BE4F7899F26145867AF5637603D5492CC441DB5613FC69A42AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2