Extracted

• • Target
    701bce4dde04226b2fff3cbd132333db8eb8248baa524fb6f4b41fcae9274f74
  • Size 45KB
  • SHA256 701bce4dde04226b2fff3cbd132333db8eb8248baa524fb6f4b41fcae9274f74
  • MD5 b44298484a058652f94cfd48fb8311be
  • SHA1 a85442ff06e270ffa0a5fee444967e8dbac8eb48
  • SHA512 d383414a0319562fae4e67ef7c6db77b7586d92717b1ab0ad064e6bcf4c236e5bb634144ed9a93c0d480af26777dfae4a97c426f40bb4f49a0805526689b7fba
  • SSDEEP 768:wuDWZTpw7bmaWUg3gSk0mo2qlyNd3u40cMOPI08zjbNgX2iBak0Vo5LXdo4bkdB8:wuDWZTpMZSB258+M3083baX/BhTezdMx
  • TLSH
    T152231B003BE98127F2BE4F7898F26145867AF5633603D68E1CC4519B5713FC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2