Extracted

• • Target
    8542d4b75f0398b296f55b74677a00d2515418815be42ab07d654c145af8505d
  • Size 45KB
  • SHA256 8542d4b75f0398b296f55b74677a00d2515418815be42ab07d654c145af8505d
  • MD5 2e636b765635279c6693041336646e03
  • SHA1 0f3aa5dbdcfa53d9923df9ff38d7383578490fec
  • SHA512 bdb39ceede4472044b3e4cad2fbd9f4031fb8321dbd0585e7cabe4792dfccad69aa940901fb52531403738c496fb30b2098c299cc0ce9e9781c028701be7b7d7
  • SSDEEP 768:cu6RaepTPYzbs8WU+Xaamo2q1UxGZGP9HuPI5zjbyg53isnNhGpla7EDBDZUx:cu6YepTPso2VGa353b15SsnNhGp47EF0
  • TLSH
    T16A231A0037E8822BF2BE5F78A8F26145867AF5636603D54D2CC451DB5623FC6CA426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2