Extracted

• • Target
    c454903403b388cae65adfce18d24d7f612356d5f9365090968ccc38ff007c46
  • Size 45KB
  • SHA256 c454903403b388cae65adfce18d24d7f612356d5f9365090968ccc38ff007c46
  • MD5 a81f0cb45dc2adb1bcd3819457d7e17b
  • SHA1 fa27cc69f4772d424cec16b82e9f918118cb8ed9
  • SHA512 64ba8b6c61833850beca1bcfa1937f1411d1d501d22d08792e6574b69f4df0e404dcff0769feb975dc5673b831c309b9734015a722ff6c8ddc888acbaff39f00
  • SSDEEP 768:MuBGJTP0BQ0UWUWHaimo2qVE10CnMQRPn98PIQrjb4gX3iphr/DDhBDZEx:MuBGJTPho2dtnbvBQ/bvXSpVnfdEx
  • TLSH
    T136231A003BE8812BF6BE4B7499F26145867AF6732603D54E1C8451DB5B23FC68A43AF9
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2