Extracted

• • Target
    13c4746bf504d390c6fdca7896f67647f45941e1a5ca591b272156f1a644b6cb
  • Size 45KB
  • SHA256 13c4746bf504d390c6fdca7896f67647f45941e1a5ca591b272156f1a644b6cb
  • MD5 499fc57d3a7e8861861d312b1e2c9a86
  • SHA1 2e95c3461703006482dcfcd774b843a9ee925409
  • SHA512 a4428a843965e1ca64db0ae499629af67b8f899d0e1fd7ea378dc20b8d289d74b8f248feb5dcfb0af8adc62abeef1eaa915d282ac0d6f6bececd93b45f4e6107
  • SSDEEP 768:cu6RaepTPYzbs8WU+Xaamo2q1HmaPylF3APIFzjbcgX3iKgx4RgAxwgDnoEBDZUx:cu6YepTPso2Wfyv3lF3bzXSKM4R7FDZ0
  • TLSH
    T16F232A003BE9813BF2BE4F7899F26105867AF2637603D64A1CC451DB5613BC6DA426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2