Extracted

• • Target
    814653f7cad92bb62184579481d2be640f36981bb5df57a3054ebe247107bc4b
  • Size 45KB
  • SHA256 814653f7cad92bb62184579481d2be640f36981bb5df57a3054ebe247107bc4b
  • MD5 5072ccc2a597af4a5d7746138c64591e
  • SHA1 c271005af22177b13b44a43ef3edbacf36192363
  • SHA512 95be2e1399ecaf7a01af6da6768edcb8cea559aa661583095dd9ccb0369f826791c494b7aea8d8e3030e4744b10f7956eb0adde59393cc7be1df73da46041bbf
  • SSDEEP 768:5udApTNctooWUS7C+mo2qttiaLMwJAOPIcAzjblgXoiX7B6Q1BDZ0x:5udApTNmU265n23cA3biXlXxbd0x
  • TLSH
    T129231B003BE8822BF2BE4F7899F26145467AF6673603D68D1CC451DB5613FC68A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2