Extracted

• • Target
    c13644ad07d3bc1cdfe1c27f37d01779775adbc78edee360134430d3cbad5131
  • Size 45KB
  • SHA256 c13644ad07d3bc1cdfe1c27f37d01779775adbc78edee360134430d3cbad5131
  • MD5 0f0ffe092ed95774e99d9b51541e3cec
  • SHA1 3991ed1728b88e542cebabb53625968f9987cdcb
  • SHA512 e585883c7b6e88fdb209ddaaded8920147009030f3b8d6999a988c39aa5669d4225117db4fa4f08cf4c8487c11b07b6eda390836cf4fd7a1fcdb53a360f50e51
  • SSDEEP 768:5udApTNctooWUS7C+mo2qtgDEbHBOjTOPI/TzjbpgX3ih9RC5V8v1gFWBDZ0x:5udApTNmU2fyYf3/T3bmXSh9wU44d0x
  • TLSH
    T168231B003BE9812BF2BE4FB8A9F26145467AF6633603D5491CC452D75623FC68A426EE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2