Extracted

• • Target
    1159edf40f226f44d5313010f5fc31e009e99d33e3bf102ab139828a1ea8a470
  • Size 45KB
  • SHA256 1159edf40f226f44d5313010f5fc31e009e99d33e3bf102ab139828a1ea8a470
  • MD5 2dfab78d214cd8ab5c5542a0300f1e73
  • SHA1 3656b0f08ad7e1223a8d894c13593e87b89d12fc
  • SHA512 fad4ee29fe9306f401aa761c3631b7731dd0a666305677453abe59d642032c1e3420dbc70560c09aebee543c75a5e48769f3707654bb499e7ad9f6f500f10d49
  • SSDEEP 768:0u1YJTHwAUgQWUaT2Wmo2q9aCSwTMjPIuSjbdgX3inCzA+PyBgwj8jQoBDZ8x:0u1YJTHcw2Ng1u+bKXSCzA+PS3QjQOd+
  • TLSH
    T12E231B0037E8812BF27E4FB8A8F26145867AF6673603D54E2CC451DB5623FC69A426ED
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2