Extracted

• • Target
    15eb17cb9273c08129a28e475f35c62bb7a635c326fba011119d124241eceb78
  • Size 45KB
  • SHA256 15eb17cb9273c08129a28e475f35c62bb7a635c326fba011119d124241eceb78
  • MD5 838dc121cb7ed37ed1abe87564bd16c2
  • SHA1 d222f2ad1c327cf25a17abb91a022e52005c9d42
  • SHA512 3645aff5a3b6662a2a9bd716e85b690cbb5209c9cf3f3534fdc3202b013c267d6f3e29056fa5303e0658df6f287d17fd9a5c646efc6c5de96b88031d8c2f9c14
  • SSDEEP 768:wuZ8pT1Uu4/cWUeT66mo2q1I0ewUkA1MiZPI7zjb0gl3i61yUNrSDBDZMx:wuZ8pT1tc2/wvDiW73bblSSSFdMx
  • TLSH
    T102232B003BE8812BF1BE5F78A8F26145867AF2633603D54A1CC451DB5723FC68A42AFD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2