Extracted

• • Target
    0756031fafb048ad685a0d0716f304d451820a235e15c7134323a0648995f4d6
  • Size 45KB
  • SHA256 0756031fafb048ad685a0d0716f304d451820a235e15c7134323a0648995f4d6
  • MD5 e91e906965ea58fd5620c4ea971f881e
  • SHA1 441973d19ad0bd5257e4bec1627422593d5a3e33
  • SHA512 0ac08c0159288a0172f3cdb2117ba244221a471a71be5f54a57c6f5ceb8b44fe00b913a379d47edc9369b13db8c822b47f0668fa681f01737c1fc9e995f834a3
  • SSDEEP 768:8uUIpT4vvofWWUEXb+Imo2q4D9wScq/z1OPIszjbDgm3iwGBZqGrDrcnFZBDZ0x:8uUIpT4vAj2Hi9K3s3bcmS9ZqeCJd0x
  • TLSH
    T1B5232B003BE8C22BF2BE4F7899F26105467AE6633603D6491CC452DB5723FC69A526FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2