Extracted

• • Target
    179ba4882a3722a5e91d39e90d13941960eebc6eb0a241ee807eeae26c4db556
  • Size 45KB
  • SHA256 179ba4882a3722a5e91d39e90d13941960eebc6eb0a241ee807eeae26c4db556
  • MD5 06d7cd22d810d2f829f14910bbb6455b
  • SHA1 e61f36b7be6c73df609935a3927e797986762e3c
  • SHA512 3d03a2a36d880baf6beed5e4ab417c3bafd42f5becf7442fecd72fd239a6fe907dfdd9359d01cd8b7fa108c1b1726ad87de9bb1f73f4f7263ca13eb366719e65
  • SSDEEP 768:UuKWgSJTwU6NkWUGnaSmo2qA2/ycD3APIMzjbrgX3lFB1p4vkzuZE0SMGKSfXC4+:UuKWgSJTwRf2mq+3lM3bUXVF94vkihQ0
  • TLSH
    T195232B003BE9C13BF27E4F7898F26145867AF2736603D6891CC451DB5B23BC69A426ED
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2