Extracted

• • Target
    13dbbdb111ff4916ca1bd77c74dac0f06b2261bc2b643a08e92abcf5953d05be
  • Size 45KB
  • SHA256 13dbbdb111ff4916ca1bd77c74dac0f06b2261bc2b643a08e92abcf5953d05be
  • MD5 d9ad672113f4cf95faad45bf16e014a0
  • SHA1 3dbd91a25ac3c0643ce23ec51c9cf20d02c65d41
  • SHA512 adc92be43b58175c16c09eaeeface0f923bf09029980fc97a1b3fec30bddd6bdee300e1c10f60158d285d934023f71e571aed7f0455de3e50705437088de2ea3
  • SSDEEP 768:MuBGJTP0BQ0UWUWHaimo2qVD0ewUkAUaiZPIwzjb1g43inOLlCkT6vKGnU5BDZEx:MuBGJTPho2iwvYiWw3bS4S5ymnCdEx
  • TLSH
    T1E2232B0037E8812BF2BE4F78A9F26245867AF6633603D54D1CC452DB5613FC69A42AFD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2