Extracted

• • Target
    132b9a853095ef971a4d067616ff3f0e12d30aabf649e4bde824680be2b79e38
  • Size 45KB
  • SHA256 132b9a853095ef971a4d067616ff3f0e12d30aabf649e4bde824680be2b79e38
  • MD5 9c47bfabbde00127548931bedfc02d5e
  • SHA1 20dd22e856388739b223acb9a7e038de7ba911c7
  • SHA512 7d17d5a910d48c96b614a622126a7fd4a71a144c8f9d892973e0c69b4e8edb8cea35315193b98f97118779bcf4b44279d84c1c2daab0388eae489bdc16d514f0
  • SSDEEP 768:EufspTfzcR6uWUcb+wmo2q9AozHy3CKPI2MjbpgX3iFTJT22CevqOYg/8T7ena1t:EufspTf2g28rR28bmXSBJTHCuFF8XI2t
  • TLSH
    T158233B003BE9812BF2BE4F78ADF26145867AF5732A03D5891CC4119B5723FC59A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2