Extracted

• • Target
    588b4fc249e0f10ae1edcc7460d8eca80a56d836facd5a1cd22234567654c9a1
  • Size 45KB
  • SHA256 588b4fc249e0f10ae1edcc7460d8eca80a56d836facd5a1cd22234567654c9a1
  • MD5 7975894fabddbfa666f57227a96ed655
  • SHA1 978d12b8de081d1c9abe815f1550f32f01e7f68f
  • SHA512 2da85af74037b2753a4d409c320eab39c391d737e65c279f87becfa2605138b71b26780d9900757903dd4bbe805faee29bccdbef4645e666c953d50d030e4fc2
  • SSDEEP 768:cuR0JTPUYkEWUmjWymo2q1N8V1yp7EcPIpzjbRgX3is/HZXBDZUx:cuR0JTPjY2+8V41Ehp3beXSUzdUx
  • TLSH
    T1EA232B0037E9822BF2BE5F78ACF26145867AF2633603D5491CC442DB5623FC69A526FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2