Extracted

• • Target
    545dfe3f1ceb642bafd73438b80d80e39fcf6076dd38098d0fe7fd3f92218273
  • Size 45KB
  • SHA256 545dfe3f1ceb642bafd73438b80d80e39fcf6076dd38098d0fe7fd3f92218273
  • MD5 ad7c99eec78a5e33494a968a8fbf9a09
  • SHA1 b9846b8b60815c50452d2505895ef084a2ccb471
  • SHA512 3ae175202c1964f7649d21c14f449894c64812f4f079136d4c128585629a790267ecd3c6503d4206cca8b02793fcb569878db5bb0ab1812e633ce1f2c2c36997
  • SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFYeeXKNopRr8/nPI6nzjbFgX3ijnDFF+ynBDZEx:MuLAZTnbg2oeQgRrKA6n3bCXS79BdEx
  • TLSH
    T1F2232B0037E8812BF2BE4B78A9F26145867AF2633603D94A1CC451DB5B13FC69A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2