Extracted

• • Target
    388f369bfc124a7df2f480007eba853d7c4a6bdcbd436bbb0ea08549a6078907
  • Size 45KB
  • SHA256 388f369bfc124a7df2f480007eba853d7c4a6bdcbd436bbb0ea08549a6078907
  • MD5 7e7d4774f7f25eb5ee0e857dc62f2e74
  • SHA1 6dd75dd259b5ce352acc3649a0b5854770e0114b
  • SHA512 bf8b99d91387f9a716c205f5171a794aecf0f4f9beec8957fb6e9bdbfe037467d572227b4620d203a06728c6938f4074906714b5f305b1cc084ef2867c4a96d5
  • SSDEEP 768:suJdpTP3tcsWUODmqmo2qVPmaPol53APIkzjb+gX3ij6Wsbb66qi27IOBDZkx:suJdpTPdI2efob3lk3bBXS2//Adkx
  • TLSH
    T13A232A003BE9C12BF27E4F78A9F26105467AF6637603D64E1CC452DB4623FC69A426ED
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2