Extracted

• • Target
    757daf3c2801024b08d0f3cf8f31953031fb4eb5838be36c4acb9a76f060e71d
  • Size 45KB
  • SHA256 757daf3c2801024b08d0f3cf8f31953031fb4eb5838be36c4acb9a76f060e71d
  • MD5 4448e5131283c228bc6c258dc546cf04
  • SHA1 94334400cbe35c4abc08a23bd6ae2d584778cc8a
  • SHA512 036550887ab5f066ae5f09b03aac2a2674a9995e6044b36b524e11dc48839120da1f40a2bd6d8759502b917f4050c8be04b83df6daa121a86f790d1f26ebfbf9
  • SSDEEP 768:8uuSpTg7GBoWUSH6+mo2qYsHO9YjoHPICYzjbcgX3iX7oNAHSm0uKAOBDZ0x:8uuSpTgyf2h6kgCY3bzXSOSSdAAd0x
  • TLSH
    T1B8231A0037E8C12BF2BE4FB4A9F26145867AF6633A02D58D1CC451DB5623FC69A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2