Extracted

• • Target
    1775350bc4b04b00c8ffd21396146921b1a9f4a1d517521bbb9534710b8edfa7
  • Size 45KB
  • SHA256 1775350bc4b04b00c8ffd21396146921b1a9f4a1d517521bbb9534710b8edfa7
  • MD5 f0c4f7016885b848aa66458134feaefa
  • SHA1 6cee4fd3ddcb4b857ba5d269386ba0486b6ace74
  • SHA512 b8082dff7f1a40a047c36496cf09eab053ffdade098b8d7f22916889bfbf118b7216583ff945007502f11056a88e6ed912358dc072db747acf09374d0f7427df
  • SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFyls5ohEaMPISJjbOgX3i2eGV8/RNcFq3BDZEx:MuLAZTnbg2X44EaxSpbxXS2V+RNcydEx
  • TLSH
    T1FE231B003BE9822BF2BE4F789CF26145867AF5637603D54D1CC441DB5613FC69A42AFA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2