Extracted

• • Target
    86f666ffe304875adc35335363f942e4a6f273ae64cd9fd0e8fefdc0d47d2244
  • Size 45KB
  • SHA256 86f666ffe304875adc35335363f942e4a6f273ae64cd9fd0e8fefdc0d47d2244
  • MD5 2336f5272c0fbe1db4396f5533bf8a20
  • SHA1 5dec13335c65b451c8baca3000a7bbfd22058719
  • SHA512 de5e346cbdba641988061f50e66156411b1e89ca87efefaeba60ee5d6982aaf1332f0c61f150e376afa6526b803ee5df6159e807d4dd1d0f96c81fb261aecf6a
  • SSDEEP 768:suJdpTP3tcsWUODmqmo2qVvzaPjlP3API6zjbQYgX3i8u2wzGZnJXBDZkx:suJdpTPdI2Gajd3l63bQPXS8ZwzGZnJ2
  • TLSH
    T1812319003BE8812BF27E4F789DF26105467AF6637602D68E1CC452DB5723BC69A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2