Extracted

• • Target
    88b144d7cf79d5fd458161d164678dda4aeaa0a8e22ba18f052dbf9139865bc2
  • Size 45KB
  • SHA256 88b144d7cf79d5fd458161d164678dda4aeaa0a8e22ba18f052dbf9139865bc2
  • MD5 4db0b9c47d484e5164ce8b493f459948
  • SHA1 48b740f12d696cff139ba80195f615e755306a65
  • SHA512 679d90873e9052c917a771ee8ec26ffe56e860d730d51fc3d531c60addd7648d2633ebc76daf8058a9099638818b0d3250414803432ae59e8f475f73cdd0c289
  • SSDEEP 768:suJdpTP3tcsWUODmqmo2qVVHUttXAPIGzjblgX3FE0rHPWnD9afymUBDZkx:suJdpTPdI280rXlG3biXVE0rv+Bafy1k
  • TLSH
    T158232A003BE8C12BF2BE4F7899F26145467AF6637603D64E1CC4519B5623FC29A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2