Extracted

• • Target
    154b6446e55569663b138a402ae8c42890106e19b2acf9372e032098040608b7
  • Size 45KB
  • SHA256 154b6446e55569663b138a402ae8c42890106e19b2acf9372e032098040608b7
  • MD5 8c87663fbe7f9204b82562a43b13054f
  • SHA1 92e16caba2b1da0975945a938cfd4fc5ad5098fc
  • SHA512 4f920dedc78020eedab065eee5311bcd9a47c3ebbaf473ab3e836b5cee9db131c84db22b3a13db6e5567386eb737d2f20408cb5bf10eada7b29f9123a78bf355
  • SSDEEP 768:EulCJTHESwgWUK3aGmo2q9TZo3TMtPIm4jbLgX3ixtQoxCIsG8LQRg+BDZsx:EulCJTHl42sU3mwb0XSoIsGQEgQdsx
  • TLSH
    T1F2231B0037E8812BF2BE4F78A8F26145867AF6673603D54E1CC4419B5623FC6DA526FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2