Extracted

• • Target
    14767cd3bad9f309bf807b27cbf42466a10c82666e689c31e45bc6e57095f786
  • Size 45KB
  • SHA256 14767cd3bad9f309bf807b27cbf42466a10c82666e689c31e45bc6e57095f786
  • MD5 608afd1f8fe2b7a7b2f7553cf697e99b
  • SHA1 13f795c5e31bba798bbaee46d71cd8a332ad39e8
  • SHA512 d8a6c322296458848f143f011776c3bfc7519a05488f97bdec41ad537aa835bd5f91fcd38ac7448e3c1534dd6f875627d264af2fd6de11f32af4f89e1fe80cd4
  • SSDEEP 768:8uUIpT4vvofWWUEXb+Imo2q4GoopCBK9INJPIZzjblgX3ia4TQVtHYZH7fTSBDZ2:8uUIpT4vAj26o6bIwZ3biXSe/YNsd0x
  • TLSH
    T1C8233B003BE9812BF2BE5F7898F25145467AF6633603E5492CC4529B5713FC68A43AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2