Extracted

• • Target
    821a2e00cc4a856e3e4193516b0d9ce81b9a9684e3bf262314249e7533690a8d
  • Size 45KB
  • SHA256 821a2e00cc4a856e3e4193516b0d9ce81b9a9684e3bf262314249e7533690a8d
  • MD5 3ade0279dd78e03f8ed5abed1d20e808
  • SHA1 aaa51ec01ac1e84c72aa404dbf03f0c0c7100fb4
  • SHA512 15af5ce8845c556c550978d60039ca32f97e01fd3a4b7d93032ae4f5b8e705e8060538b663fe812c9ee3b7fb283028a77cc5d5dac36390bc4a372b510914054b
  • SSDEEP 768:cuR0JTPUYkEWUmjWymo2q1N8V1RpPEcPIMzjbagX3i2qti9E6OfTBDZUx:cuR0JTPjY2+8VDZEhM3bNXSn/dUx
  • TLSH
    T1E1234C003BE8C22BF2BE4F78A9F26145867AF2632603D64D1CC451DB5713FC69652AED
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2