Extracted

• • Target
    1676c9ecde6058c2a7a97c991be2e06ee0163c890e775f774fc9a876ff1f0ce1
  • Size 45KB
  • SHA256 1676c9ecde6058c2a7a97c991be2e06ee0163c890e775f774fc9a876ff1f0ce1
  • MD5 4df48f9175d676536af2409b98142eda
  • SHA1 b906df6c0e69f33b0f3c29ae3ef127d88b4b0a2f
  • SHA512 9525df5683c2770455113c10633f228bc380d491512c4cd9451a49b9b8624e7ea436ec2552d4385b0e72bf123361ac4e1d088c0d6b19b3caa534efe0b11402e9
  • SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFA7lt440WMOPI0szjbOgXRiVYMAH8x5tzBDZEx:MuLAZTnbg2VgUM30s3bxXAVYMlBdEx
  • TLSH
    T15A233A103BE8C12BF2BE4F78A9F26145867AF6633602D94E1CC451DB5613FC68A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2