Extracted

• • Target
    27e82de5c3d4592ecd76e6a54dbfbf2dd59c9468e87ba1b32d4f0a8f3ccc62a7
  • Size 45KB
  • SHA256 27e82de5c3d4592ecd76e6a54dbfbf2dd59c9468e87ba1b32d4f0a8f3ccc62a7
  • MD5 8449d19e9f12a7fc762ff53d5817c838
  • SHA1 5b5a11afffbad9b6535e5456420d9b1b7e92a975
  • SHA512 1f5b1f8d7cb3eb612e0b8baaa75bc6d083f74dbc7460dcfcd4e3a11a5db3036cbd804cb55cde52bd18f32e47138aa6ba92b94f4e10efe2f428df022a51129a2d
  • SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFEfBohEa+PIv0jbNgX3i4MN0Tqzbi0GGyBDZEx:MuLAZTnbg2Z4EaHvUbaXSo02dEx
  • TLSH
    T16C232B003BEC8227F2BE4F7899F26145867AF5637603D54D1CC452DB5613BC68A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2