Extracted

• • Target
    2163a7c40d88119859425fbef7bf493761da696a18cff992a0eb27215f2e3853
  • Size 45KB
  • SHA256 2163a7c40d88119859425fbef7bf493761da696a18cff992a0eb27215f2e3853
  • MD5 8bc02bccaeb1277e7193bf8dcc6ecd26
  • SHA1 0e7ef9ea155426e7733d399956116b84b0aad8dd
  • SHA512 1580d6759ea17912ed9a319408d837f58e8064414b206a880ef1693c1a486eb9a093ac3c791bcac8ac5ce0f88c95c29f4121f46bed9f6e00acb5b5da944c1044
  • SSDEEP 768:5udApTNctooWUS7C+mo2qtSCSwTMjPIuhjbcgX3it8YsWp7SAPcaBDZ0x:5udApTNmU2lg1uxbzXSGYsdocEd0x
  • TLSH
    T151232B0037E8822BF2BE5F78ACF25145867AF6677603D64E1CC4519B1623FC68A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2