Extracted

• • Target
    be74cfed958d59f085ac10066c26fad2ba74336795e3cdba96cbaac458c41dd1
  • Size 45KB
  • SHA256 be74cfed958d59f085ac10066c26fad2ba74336795e3cdba96cbaac458c41dd1
  • MD5 7616f825a0ce77f057634f28f5469827
  • SHA1 d8598d227fe6ae8183a50517ca020e6c57d00a06
  • SHA512 5331c0867394edf6fa0e2a2b250baa38ef524ce39714f447b0b81b712eeb61a4cd4c69936ab1f9c0373d8503d14253988016f4ea21a4b4462401cd46e60884e8
  • SSDEEP 768:wuZ8pT1Uu4/cWUeT66mo2q1nLiE02FjMdjYkkmPIyzjbkgX3iXk9AKbiKl+AdUVu:wuZ8pT1tc2KL9wQPy3brXSUWKddwdMx
  • TLSH
    T19A232A003BE9822BF2BE4F7469F26145867AF5732603D6491CC451DB5B23FC68A42AFD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2