Extracted

• • Target
    106feebde04947c7728c1755d06bf5b839689779fc939c857a384faad2c4d504
  • Size 45KB
  • SHA256 106feebde04947c7728c1755d06bf5b839689779fc939c857a384faad2c4d504
  • MD5 74f882a5a526369c21fa022eb6c24ef2
  • SHA1 246d3ced566ad58f52bee38f268cfd9f68cca4a5
  • SHA512 70e25c4d70746b914c5cfa398c9c7e2b117296bab3a74af269a68f8a159fe71c985786e3cfb77e74c1931567dc147b1497bf4c167d165b6c6b55ce0b54f3dd46
  • SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFkzO6wjoOPI0zjbDgu3i7Vb1Txmyo/7UeazoMmOBDZG:MuLAZTnbg21S3o303bcuSbTxr0UFcAdG
  • TLSH
    T1C6231B003BE8C12BF2BE4F7898F26145467AF6677603D58A1CC451DB5A13FC68A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2