Extracted

• • Target
    180f448483ee0f9aa69c89f3bb268c94388d189905f3f62e4609feba26484511
  • Size 45KB
  • SHA256 180f448483ee0f9aa69c89f3bb268c94388d189905f3f62e4609feba26484511
  • MD5 d343bcfff1d43b45c14ba18fb9a4da66
  • SHA1 d2839064fdd965654d7370b6cce4596397a8ab54
  • SHA512 67fa448a4120d06bb958e786f8e0bb4a094427797ea8b7cd0c7e27a15c95b997b9e28ef261b8826a36996cee7f00c3583395b360bc1cbe3e22660ac4a3fdfbe1
  • SSDEEP 768:MuBGJTP0BQ0UWUWHaimo2qVmVllVc6GcPIAzjbHgX3LxNRW4NbmAYzrcyhBDZEx:MuBGJTPho2nV/26GhA3bAXbNW4fi/dEx
  • TLSH
    T11E231A003BE9C23BF2BE4F78ADF26145467AB6636603D54A1CC4429B5613FC6CA426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2