Extracted

• • Target
    709d71d1e90e28faea9a44c791d32980e9dde13c4b1c27c24441629a4ed584d8
  • Size 45KB
  • SHA256 709d71d1e90e28faea9a44c791d32980e9dde13c4b1c27c24441629a4ed584d8
  • MD5 1add2997e9eca8f0085ee498e3ae9194
  • SHA1 e86e3789edad6962f913ef168106b6623260ea95
  • SHA512 26438027aaea049ed6218df442adcde7a36c35b99617951c774ea5b22366fe5414000ac06aeff1325444fbd782d17df1bdcd2c2da2fc66906d5a2b4fc43967ef
  • SSDEEP 768:UuKWgSJTwU6NkWUGnaSmo2qAe/qpG3jHuPIszjb/gXki/0w18rBthC4kGBDZcx:UuKWgSJTwRf2OIM3s3bIXh/0w18rtCUs
  • TLSH
    T1B72329003BE8852BF2BF4FB8A8F26145857AF6637603D6491CC451DB5623FC68A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2