Extracted

• • Target
    f62186cbc716aa82ef0cefbc6c55ed557f707d2a7ba854390496ea2547df5a22
  • Size 45KB
  • SHA256 f62186cbc716aa82ef0cefbc6c55ed557f707d2a7ba854390496ea2547df5a22
  • MD5 7eb1e3136d390b596bfb34cc636e562c
  • SHA1 cfe3cdb059d1eb9a09041a51ced41e9c9b2ce149
  • SHA512 55a0eba55496915b8beda694b6e04e55919030e8558c399597d2239d46d834ed34e6c48984efdfadb8db48942e6f3b2b0f6f8131d8603d754fa2fd67d1afca56
  • SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFMSAFcKoabbb4ZhM/RPIAEzjbggX3i1FnNfT9H90IBE:MuLAZTnbg2vSAvQZh6OAE3bHXS117d0J
  • TLSH
    T146232A003BE8C127F2BF4F7899F26145867AF6632603D54A1CC4519B4713FC6DA42AED
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2