Extracted

• • Target
    148b4156c06ac7f84f7e8a7beca712ad82b003f726d0e8eef1c1f88c55876b16
  • Size 45KB
  • SHA256 148b4156c06ac7f84f7e8a7beca712ad82b003f726d0e8eef1c1f88c55876b16
  • MD5 6b55d2bcb6ffc526af0b7cc552fb8eb8
  • SHA1 33f2b962013952d3f044d6b324fdd2cb3f528dba
  • SHA512 a7589570cf5867aa302e8d596abb8610cdd1ee7e582209d8935900161bb76c0a89c9712aabbc86e9b317db58826fe58aabe289dd3e034f02f3c0da8cef816f7b
  • SSDEEP 768:4uLZZTUAoOSWUYZL8mo2qFRlsHoPEaMPIPgjb3gX3iYEz1E01WBDZbx:4uLZZTUTn2guuEaxPIbQXSYEz1E06dbx
  • TLSH
    T1BA233B003BE8822BF2BE5B7859F22105867AF6776603D54E1CC441DB5713FC69A42AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2