Extracted

• • Target
    71d87b74956d123632bb71941243d7f34ef959698687a71b254eba5daca5d9a9
  • Size 45KB
  • SHA256 71d87b74956d123632bb71941243d7f34ef959698687a71b254eba5daca5d9a9
  • MD5 568ff8eda643cecafd0246f37c62a46f
  • SHA1 71b6ff4bb9e914e2d7f4b21c75186d5b2ac9a4a3
  • SHA512 7ebdf0fa99aec6e03ed9c49231f12d2c4ac2327d04573b64200e01e14626942099afb0afa44f332ed51c513173aa981d36b087bb046aa4305df2b4fd7f07af5f
  • SSDEEP 768:8uuSpTg7GBoWUSH6+mo2qYh6R8aI3OPIOzjb8g93ijC/o5n/y4SicBDZ0x:8uuSpTgyf2J+FO3O3bT9Sm/o5/yji6d2
  • TLSH
    T1B6232B003BE8812BF2BE4F7899F26245827EF6677603D58E1C84519B5613FC68A427ED
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2