Extracted

• • Target
    15fdea99f72671de81c307862c0ec8c9fea11660c6851e94dfc14de4edef663a
  • Size 45KB
  • SHA256 15fdea99f72671de81c307862c0ec8c9fea11660c6851e94dfc14de4edef663a
  • MD5 1a7050c3cf55ca35919a8507a4e55aab
  • SHA1 d0b8520a3d7adad37224b2a4636fdf88ee38c507
  • SHA512 49480b4759a0f9a96b1824154be4a187d6cb881ab6ac2bd7f46976571a1320eb6ca2ea022abb441d23deb0e23801843174018e96408cc4a27156680bca441823
  • SSDEEP 768:8uUIpT4vvofWWUEXb+Imo2q4gozHyvCKPIiJjbKgX3i3OVKw1IfofLlatRycBDZ2:8uUIpT4vAj25L5ipbdXS3OEw1Iw5iVd2
  • TLSH
    T139231A1037E8C12BF2BE5F789DF26245867AB6633603D94E1CC4119B5713BC68A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2