Extracted

• • Target
    13188ac6e3b9fa0d83fe41785b45130755993179127605fec022e5607c133b98
  • Size 45KB
  • SHA256 13188ac6e3b9fa0d83fe41785b45130755993179127605fec022e5607c133b98
  • MD5 52ab3b12fbe70c366266bd8e02b61a74
  • SHA1 0bb399f4448348ae0f8c1a590deaddb4fa76fb99
  • SHA512 719e5df70dcb60013bd69de1a64b18f891675ef3def42524a2c68b75caa729a18e750c3085e2a65b41dca00f9b207a769729d2b7fe6db104aab60f2e1324e757
  • SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFw3HO4SNMOPI0azjbFgU3ilRlIoo8HyYimxBDZEx:MuLAZTnbg2R+JM30a3bCUSBo8hdEx
  • TLSH
    T14B231A003BE8812BF2BE4F789DF26145867AF6636603D58E1CC4519B4B13FC696426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2