Extracted

• • Target
    817ba84ce61e41158ca99be397a32befecd8a7dd3cdf6512adb38ce8d22f231f
  • Size 45KB
  • SHA256 817ba84ce61e41158ca99be397a32befecd8a7dd3cdf6512adb38ce8d22f231f
  • MD5 64e8a7ef5b17871f9f5b883cd80cb7bb
  • SHA1 42c0b119af89aa172aa06f4b395ee5577ff87c5f
  • SHA512 c7fc69c38c3c261f71dd02aefbd0c07b1a580734e883a56f97e2b3bd9d6c22bb3c432a42b62508547d6e065b839dda595c6d2585105f8cf5d2b19b487fd527ff
  • SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qF33Fo9EaOPIUzjbdgX3ioWmGs1BDZEx:MuLAZTnbg2C8Ea3U3bKXSo3dEx
  • TLSH
    T176232A003BE8C12BF2BE4F78ADF26145467AF6636603D6892CC4119B5713FC6DA426F9
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2