Extracted

• • Target
    1626c05da8d26613ccf630f09a7f3a19f620c7200efe683070565374f2daf123
  • Size 45KB
  • SHA256 1626c05da8d26613ccf630f09a7f3a19f620c7200efe683070565374f2daf123
  • MD5 6c8fc0424ad52046be8bd8768ea77fe1
  • SHA1 ee56313fd7b939f1a4c4e4b0e378fc45863dfc45
  • SHA512 c26eec7511c527ec7a98ce50e93ee18ae31e4248177fd9c3f2f8f5e83b4ed471d8b44fbde8b54b7bd2b01324996c67110576cd77150a9ee22f9c542339b1ea69
  • SSDEEP 768:0uPrpT/LGKeWUszuAmo2q9zzjHynaKPIsMjbrgX3i2pPgVssH7BDZ8x:0uPrpT/qY2QnZs8bUXS20sSd8x
  • TLSH
    T152232B003BE9C12BF2BE4F7899F26145867AF5632A03D58E1CC4519B1713FC68A526FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2