Extracted

• • Target
    89a0edadfb227fab3b91ce84e76045e99f3c6c39aaf0a22f40344997f14dacfb
  • Size 45KB
  • SHA256 89a0edadfb227fab3b91ce84e76045e99f3c6c39aaf0a22f40344997f14dacfb
  • MD5 233461273eed6b6d07df0729e39b1cf8
  • SHA1 ea66575d98acfa8034c59d46fc50f98a16125052
  • SHA512 9bf56078dc878f5d9818ca01cb5472afc57d93da47578645a3d59af9cff3b6d9df64b468aafa392bcb5ec1895f7aa5312e9e69452fc3cffd21bb3f1d63b155f9
  • SSDEEP 768:suJdpTP3tcsWUODmqmo2qVMw0QbKXPI+zjbAgX3iDZQ7iyDGJ6hnc3WBDZkx:suJdpTPdI2R8+3bnXSD22ySJ6Bc34dkx
  • TLSH
    T14A232A003BE8813BF2BE4FB868F26145467AF6636603D54D2CC451DB5623FC6DA426F9
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2