Extracted

• • Target
    77a7355d2e83b30f0d74db15a2eb43d4e66aee759fbcd00f571cbe187ca3e9a7
  • Size 45KB
  • SHA256 77a7355d2e83b30f0d74db15a2eb43d4e66aee759fbcd00f571cbe187ca3e9a7
  • MD5 5815bd7da9f291e883defb1b5076e37c
  • SHA1 814f2804cade312d78a1c8756baf3b891d03df47
  • SHA512 bc3c660cb87a82c4ae7eb30b49e92767f5b7d8f63bf7d5db72e165d5b35f37c2e94d94805f90c3f9cb34607876ed9650938271d1629405c563d3c79e0d8c19dc
  • SSDEEP 768:EufspTfzcR6uWUcb+wmo2q9D9Y6kq/zNOPIyzjbFge3iu741oOBQABDZsx:EufspTf2g2Oa9C3y3bCeSPQWdsx
  • TLSH
    T15E231A0037E9C12BF2BE5F78ACF26145867AF6633603D64A1CC451DB5623BC68A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2