Extracted

• • Target
    615a570f1769d0e406432b6168c56b5ba75688c1a28942f60b4b35c0c3979826
  • Size 45KB
  • SHA256 615a570f1769d0e406432b6168c56b5ba75688c1a28942f60b4b35c0c3979826
  • MD5 0b2fc283e5f4cff978b6cbf3a76c3e67
  • SHA1 71faa0df68db3c467d15b740c576e77668a17512
  • SHA512 51751b979a9142e6a92d0475dfab0c9befd053e09fc15c69095263d85823f5bac0ddabef70d1f94906f734d22a37aafba6a5d6866edbc88eead947090a4ad1eb
  • SSDEEP 768:Iu5KkpTsU6Q8WU+xjamo2q1x/7ct3APIPzjbTgX33XynJT8jBDZLx:Iu5KkpTsx/2YDY3lP3bMXnXiYdLx
  • TLSH
    T199233A0037E9812BF2BE5F78ADF26205467AF1772603D6491CC452DB4623FC69A02AFD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2