Extracted

• • Target
    f26713df9564c55c485aca54d38ef39da3e9d20145d672f0bceb7e030c96fa47
  • Size 45KB
  • SHA256 f26713df9564c55c485aca54d38ef39da3e9d20145d672f0bceb7e030c96fa47
  • MD5 61b6a2d2d8d5acc0908e688d69f69e45
  • SHA1 0b869244e39b51acf59ea98e11574fe5ba070a79
  • SHA512 0230dd81361bb03e9e9a322a240c136d7bf20af9d88328d1e8f34cd113a9de4c8aa1297749e22c72d85b07d1164892ca0518ab49d911d68ef538a2e3a17d8509
  • SSDEEP 768:MuBGJTP0BQ0UWUWHaimo2qVufPLzizpvtLjZPI9zjb8gXTipcCZFnrlhVBDZEx:MuBGJTPho2HfHi1VjW93bTXOemnxh7dG
  • TLSH
    T167232A003BE9C12BF2BE4F78ACF26145867AF6632603D5491CC451DB5A13FC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2