Extracted

• • Target
    763ca04ed659097597ac84488e7aa7c5fae887eb430317a56a4977da4e6f11b3
  • Size 45KB
  • SHA256 763ca04ed659097597ac84488e7aa7c5fae887eb430317a56a4977da4e6f11b3
  • MD5 d7ad3b32ec8ef90a0f92862861dc0708
  • SHA1 df1011ca934326bc3f258d4373fcca01580cf228
  • SHA512 fc1b8ea3c09b2f1d7e2f815a51dbd83331fa14d47c3dfa688ad923de3c1d2c989cfa3ceb5db2f583918d8f3c86a737af93e1f016330ccc10075047ffbd955ed0
  • SSDEEP 768:cu6RaepTPYzbs8WU+Xaamo2q12FpPklON8APIDzjblgX3iOV7mvkm5xRvXESBDZW:cu6YepTPso2f7kwN8lD3biXSOV7mh/pg
  • TLSH
    T1EF232A003BE9812BF2BE4F78A9F26145867AF6637603D64D1CC441DB1623BC6D6426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2