Extracted

• • Target
    0687c49b152276a212571401cdf86869dac9d0136175ef55e2354d3e1abe3f0d
  • Size 45KB
  • SHA256 0687c49b152276a212571401cdf86869dac9d0136175ef55e2354d3e1abe3f0d
  • MD5 49a1939f5d767c65cd9c8ed175a27785
  • SHA1 55cf9b8471728639fc9a925fb9308e9cd868c853
  • SHA512 b853dd3bd73255e35df5015cbdea84e385a489ee5424eb5282d879e4014457f739eae9292f12bf612f9e275f33cc7a87bb87236670f8533594572965eb7c80d6
  • SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFo3xY6aZOOPIgzjbogP3idjVEarymzBDZEx:MuLAZTnbg2Ru/O3g3b/PSdjW7mVdEx
  • TLSH
    T1BE231A003BE8812BF2BE4F78ACF26145867AF6637603D54E1CC4519B5A13FC68A526FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2