Extracted

• • Target
    13793591a315e072c852a1ef637e20b05f7d28e3d6de7e61d2be95396bc7e3c8
  • Size 45KB
  • SHA256 13793591a315e072c852a1ef637e20b05f7d28e3d6de7e61d2be95396bc7e3c8
  • MD5 0d6d1e091201dd552e0ed1b73a519859
  • SHA1 4f3d1239151f284d42541880a23cacb2d4bf5920
  • SHA512 6d0d496cd48c782d1db46ea8fe2a011ae1406f5b45a377b38120bd1d701c23d3c1316bc6f898aea29fe14bf5a62263faf3bd5ef99b6f556d0de6f2f97680b049
  • SSDEEP 768:8uUIpT4vvofWWUEXb+Imo2q4D9YSkq/zNOPIFzjbJgA3ifABmnmBZBDZ0x:8uUIpT4vAj23aVC3F3bGASfABmngHd0x
  • TLSH
    T19A233B003BE9C13BF2BE4F7899F26105867AF6673603D64A1CC452975613FC68A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2