Extracted

• • Target
    642ebab990d83cf5726e6e8965b84789a92ff6607c538eab89f772a82d4ebe13
  • Size 45KB
  • SHA256 642ebab990d83cf5726e6e8965b84789a92ff6607c538eab89f772a82d4ebe13
  • MD5 f15ccae8818de089a3fb52c24b69a353
  • SHA1 54d93551a32bd62524afd3fc0d010b74f7810ea5
  • SHA512 6f3efec5f71baec9a892285eb40698081ed7ef12f4b88d65f6b6de2b0037cc6396de2e85c9e1a1622a912b890dbfba86a7543b627ec999410b32297228fa4e23
  • SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qF33Fo9EaOPIRzjbEgX3iat0Qch6yBDZEx:MuLAZTnbg2C8Ea3R3bLXSat03vdEx
  • TLSH
    T12C2319003BE88227F1BE4F78ACF26245467AF5736603D54D2CC4529B5613FC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2