Extracted

• • Target
    15914f6c70549614e316f2fd46f5ca65e5dd3db8a78aa807340bdd45729a7eb4
  • Size 45KB
  • SHA256 15914f6c70549614e316f2fd46f5ca65e5dd3db8a78aa807340bdd45729a7eb4
  • MD5 38a42287a6d35a1295478295c5c9e559
  • SHA1 ef10cf73d2cdef9e1dae6952e0fb8d13f989439b
  • SHA512 8df64a936d79845ac88e129cf74c9a68e370f586783948af78ad2464e982024b193d346e42694928169eb4f9b9b3a1c20655d3c06c256a56e912d302dca59862
  • SSDEEP 768:EulCJTHESwgWUK3aGmo2q9cx1HJhOPIcozjbagp3it0+MEB6KAXx2BDZsx:EulCJTHl42tFj3co3bNpSZMKAXWdsx
  • TLSH
    T155231A003BE8822BF2BE4F7898F26145867EE6637603D58D1CC451DA5713FC69A42AFD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2