Extracted

• • Target
    14186d49fde11bd01ff70ff7f29823411aeceee33011b92e55eb0b67e3419dc6
  • Size 45KB
  • SHA256 14186d49fde11bd01ff70ff7f29823411aeceee33011b92e55eb0b67e3419dc6
  • MD5 fe7be229cba09045fd6184631452f49d
  • SHA1 41985b4ebd0d2f082ac85fe3bbcd9d1734c445ac
  • SHA512 78499ade87cb054d6de74f88cb88e1b0dc8caaec24803b95e3c66993d8e0769212ea35774a222b0ff66a4db5404296e94847dd6a55ce3915d62d5c3cd9c941a0
  • SSDEEP 768:wuDWZTpw7bmaWUg3gSk0mo2qlRhk6K7OOPIzzjbMgD3iDX85MDQ31an6vYP3BDZO:wuDWZTpMZSB2I6VO3z3bDDSDXIM5n6Q2
  • TLSH
    T124231A003BE8822BF2BE4B789DF26145867AF5732603D54A1CC452D75A13FC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2