Extracted

• • Target
    ca085169f1d7d751e6ac1243e2ea59dec37b4592731c15566ca1ad8f4741d82d
  • Size 45KB
  • SHA256 ca085169f1d7d751e6ac1243e2ea59dec37b4592731c15566ca1ad8f4741d82d
  • MD5 48fba27fd59f16f41e0bc00a4c72d806
  • SHA1 824b5ec5f51d91ec3c0641403ba4ff622df2f929
  • SHA512 6ff4c6739a5562c429bc41e4fb258423439bf007860938faf4d1f527aec3566840ce946162173cadc3ec1c6cf452e2dce525c3007c8c25f29daf5082ec54f053
  • SSDEEP 768:5uSy6pTpwrSWWUE3/WImo2qNDIz/yPqiPIgzjbSgX3iUq5GqtWxbhyGFBDZ0x:5uSy6pTpoo2gc5g3bVXSUMGOWvyGLd0x
  • TLSH
    T17C232A0037E9C22BF2BE4F78A9F26105867AF6632603D64E1CC411DB5713FC59A526FA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2