Extracted

• • Target
    86a244c9a55b7783d3cc40b464c154b906d577483372f65deabec21ffa743f3e
  • Size 45KB
  • SHA256 86a244c9a55b7783d3cc40b464c154b906d577483372f65deabec21ffa743f3e
  • MD5 8afdcdb0fbfc379fa01692cae3b99617
  • SHA1 4d5dce409fd68f44a35ba38853cd1bd16ba44628
  • SHA512 3f5f65166672d3e6349db16d0fe57117a46162dfd4c9efade52ffdbbfd8df3871cbdd9595c1fc11a028d4791280da90fbc3666ef51697498331b9f1468c829ff
  • SSDEEP 768:0uPrpT/LGKeWUszuAmo2q9q9YSkqXzNOPISzjbwgb3idt0UGu/grBDZ8x:0uPrpT/qY2XaVq3S3b3bSd+yg9d8x
  • TLSH
    T1672329003BE9C12BF2BE9F7899F22105467EF6632603D6491CC451DB5613FC69A42AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2