Extracted

• • Target
    0167119c40932da6e0314a71a37adc20d2f46a253adcec4a2b24922f156cc4de
  • Size 45KB
  • SHA256 0167119c40932da6e0314a71a37adc20d2f46a253adcec4a2b24922f156cc4de
  • MD5 50684dceb34d4cfe018934b3163a7532
  • SHA1 e93e101d9f700e645af9f10a750a2276964e16f7
  • SHA512 d02e1a206c852ff82bc832d58ea12a926e0ca8d2beead76241fd460427db3d6f1140481c9fe7cfe5c1607d8b0bbbcca9131a6abf20115d140d287033f34596e9
  • SSDEEP 768:5uSy6pTpwrSWWUE3/WImo2qNC9Yq3q3hOPI2zjbagX3isFkIFwFF8m4BDZ0x:5uSy6pTpoo2/aCq323bNXSobFIFAd0x
  • TLSH
    T1D7233B003BE9822BF2BF4F78ADF26105467EB2632603D54E1CC451DB5613BC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2