Extracted

• • Target
    898ecdcff44b85c71ee24047e2bef751000c69cc0bf9b24c74c0e643de871f60
  • Size 45KB
  • SHA256 898ecdcff44b85c71ee24047e2bef751000c69cc0bf9b24c74c0e643de871f60
  • MD5 97dd00d0518dbe950055d9a62f9abd90
  • SHA1 f30648667469d8e8be88797bf0073b62654b17ee
  • SHA512 33f3320368e3d29d48b077f8047430fe83c07609317314618ff0e6a080cdf5b7e13a300a7fa149833a276e218f2eb050e49fe5a59e5040b853ee4da6cfdfb5bf
  • SSDEEP 768:5uSy6pTpwrSWWUE3/WImo2qNHoopCBK9INJPIZzjb1gX3ihWpo8BDZ0x:5uSy6pTpoo2So6bIwZ3bSXSop5d0x
  • TLSH
    T10D231A0037E9822BF2BE4F7899F25145867AF6633603E5492CC451DB4713FC69A42AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2