Extracted

• • Target
    27aff7647b74186890942d69a0d902c8d761f344bc4e7390bd5bbf8eeee2b4ef
  • Size 45KB
  • SHA256 27aff7647b74186890942d69a0d902c8d761f344bc4e7390bd5bbf8eeee2b4ef
  • MD5 05d08d46695c55bf231dcc2552ac5c82
  • SHA1 0009f3ba90597970a7822d1f2447941e3d5c9166
  • SHA512 ab3339b31042df08d2c8337e35a612f81c3492bebadd17da3268933dcd0e9a976c21b86b1c00265f76526c1acc8de21ef35b5b9ca88aa9b40bbc2d25be640189
  • SSDEEP 768:RuxkJTVmU5EkWUGMKSmo2q1fw0Q+KXPIwzjbcgX3iTITf71PuKVkNGBDZcx:RuxkJTgip2w9w3bzXSTQPuW5dcx
  • TLSH
    T13A231B003BE88137F2BE4F78A9F26145867AF2637603D54D2CC452DB5623FC68A426ED
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2