Extracted

• • Target
    45fb16ada5b7f194a13f67c498f70fe1317538a3d2341bb90a4bb8368de157b4
  • Size 45KB
  • SHA256 45fb16ada5b7f194a13f67c498f70fe1317538a3d2341bb90a4bb8368de157b4
  • MD5 73360f8dcbb7038dd4c9816bf1eb6dce
  • SHA1 6e4bcc9f5389a3750a7e09145cb11569dc827fab
  • SHA512 6969a9ae37c8a39983ceccb22de39d445822bfdac18cd79297c7b1f97c02d356dd798b2c7cdc08178fab68b4699a01dac8b3b2c4968007247a07f094bbebd007
  • SSDEEP 768:wuZ8pT1Uu4/cWUeT66mo2q112q0CCMPd4CvS8PImHjbkgX3iXBSuYjPmF+8PBDZO:wuZ8pT1tc2MRCEWBmDbrXSxSuKPmQgdO
  • TLSH
    T1BE232A003BE9C12AF2BE4F74A9F26245867AF2633603D54E1CC451DB5723BC68643AED
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2