Extracted

• • Target
    444c8ac1372e768d43225ea6595e5b0ef7f6caf011357105fc23c8d53f9f199a
  • Size 45KB
  • SHA256 444c8ac1372e768d43225ea6595e5b0ef7f6caf011357105fc23c8d53f9f199a
  • MD5 64802f805a33cd5e11f0e9785e7f7776
  • SHA1 8b0731c53db11001a4ddc2ce76cab38a6fd2ce5f
  • SHA512 449196ac4e331137f153ccfbfacb01ea2718670c85731226ec5e70e17c60d08161f5d80912da84a59d7a07110493f0fcee0ea0220104560e8d465370c1b2deb9
  • SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFdm/9GgrOPIRzjbQgX3i8XO/Y/VexC+VagkBDZEx:MuLAZTnbg2um1b3R3bXXS8/4xCZdEx
  • TLSH
    T159232C003BE8812BF2BE4F7898F26145867AF5637603D54E1CC452DB5A13FC68A526FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2