Extracted

• • Target
    184fca6451f32ee4426690d845de10eeb51c2731d4bc08c62f3910d379aa3364
  • Size 45KB
  • SHA256 184fca6451f32ee4426690d845de10eeb51c2731d4bc08c62f3910d379aa3364
  • MD5 8bf2b5d7f9f6690199d37b85ca8a044d
  • SHA1 aae2377821303756f5a0030c4c695c3dde2df70a
  • SHA512 2bffeb4d0b1ae44d3ac30680ff40d1ff8223e902c0b45134824c22f704c3efa93cac0bc7248280e407ba55cc2ef5d141a4b08c96fff289076aa99a3d897760b9
  • SSDEEP 768:cu6RaepTPYzbs8WU+Xaamo2q12FpPklON8APIDzjblgX3iL9Kf/mhZiL8BDZUx:cu6YepTPso2f7kwN8lD3biXSL93dUx
  • TLSH
    T143231A0037E8812AF2BE4B789DF26145867AF6637603D64A1CC451DB5A23FC29B426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2