Extracted

• • Target
    144ac3d4ad93dce5f94bb998418a542383af4d4dce7b6b0ce66642de4cb67bad
  • Size 45KB
  • SHA256 144ac3d4ad93dce5f94bb998418a542383af4d4dce7b6b0ce66642de4cb67bad
  • MD5 13b5d8e9c0ddeb3a6a1701112ccf05e3
  • SHA1 e300eb864ee1be366db457b2a9cbead219d59bf5
  • SHA512 e4de9cefaa1ee10c072858d6defe41afe4ff096b296fe45c41ec26ff60e4ddda3c1439ca4f9ab9acdc5faa9eaea84b1a18e8187ca785c8dd35a1d8c8343d986f
  • SSDEEP 768:8uuSpTg7GBoWUSH6+mo2qYhoRQKIJOPIhzjbPg23iFc7BvHFBDZ0x:8uuSpTgyf2JYxg3h3b42SC7BTd0x
  • TLSH
    T1A7231A003BE8812BF2BE4FB89DF26145867AF6673603E58D1CC4519B5613FC68A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2