Extracted

• • Target
    914158128333ea5b800736af45be6f1478b7df9af3e8c8be3649dda99d73f0ac
  • Size 45KB
  • SHA256 914158128333ea5b800736af45be6f1478b7df9af3e8c8be3649dda99d73f0ac
  • MD5 8c0599c66ad8ada9b1dad7af15a037cb
  • SHA1 4dc5391c81264edf0c8b8b8f0d35e2527ebab029
  • SHA512 2d5b2bb7b403cb3e4f6579ac6dfa408a677923aea48eae6c9796921b634eba0c13a74c2d23f22979d2a548b8ab753c2fc779298ffc4caec782a080c93171ccd3
  • SSDEEP 768:wuDWZTpw7bmaWUg3gSk0mo2qlKm/9GgrOPIRzjbwgX3ic/i92GB8t222/oHuBDZO:wuDWZTpMZSB2Bm1b3R3b3XScK92A82Az
  • TLSH
    T165231A003FE9812BF2BE4F7898F26145467AF1B37603D64A1CC4519B5623FC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2