Extracted

• • Target
    26847a5986a4494fc732c00608277df5fcdf072f8d7460b638716694d85f5640
  • Size 45KB
  • SHA256 26847a5986a4494fc732c00608277df5fcdf072f8d7460b638716694d85f5640
  • MD5 15d96821f2a23271fc15904931c11ab8
  • SHA1 b70244137844b1658e98d0c4f2f4d664d2176d00
  • SHA512 fbf4c41295216c7fa4459fde2d59987bdd1bd182e5f78dff49f03223a498dd28001edc645af72b4d798783d71d661828e4585120f79f3349132b2f28cc45f44b
  • SSDEEP 768:vuogpT78XvEsWUOsRzqmo2qrHoCablx3API4zjb+gX3CbJYXF/tBwKBDZkx:vuogpT7I62wEb33l43bBXSOXFzwUdkx
  • TLSH
    T1D4231A003BE8812BF2BE4F78A9F26145867AF6733603D54A1CC451DB5623FC69A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2