Extracted

• • Target
    ba183a662ceef1a618805ec97e04927a56817da9829ecc51a5d94be921000441
  • Size 45KB
  • SHA256 ba183a662ceef1a618805ec97e04927a56817da9829ecc51a5d94be921000441
  • MD5 57069379e6118035f970bd7cad265e0a
  • SHA1 ebc5d4a85e753995ab923ea7d039838a7c7538f7
  • SHA512 474eaa2cdc38bae03aefe92629562ab8f2f41af0320adac8faae45b055861d4c99643e0876a41e830c3f6d649f2875a08b7e3d83f9c88834b6d45b31e6b795dd
  • SSDEEP 768:0u2vpTD4U2ieWUsqfAmo2qjoO5QyCBjHSNjPIwzjb6gX3inGSgKfuF1P8FBDZ8x:0u2vpTDe+2vO59ESKw3btXSnGTKw8Ld+
  • TLSH
    T149232A003BE8C12BF2BE4F7898F26145467AF6633603E5491CC452DB5613FC6DA52AEE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2