Extracted

• • Target
    723f8153467fca6a0c92cf1528e5df5a9359cf5c3062b64fbd1f5164a5b22a36
  • Size 45KB
  • SHA256 723f8153467fca6a0c92cf1528e5df5a9359cf5c3062b64fbd1f5164a5b22a36
  • MD5 d522e537abfeeac7eb1be83804b64510
  • SHA1 811fa6515bcad8fe1a98710f8d8a3f87634f9dc7
  • SHA512 78edf8d492ea55730ca28d16bbbdf99c8ce5fc62b33d6683f91c4fca3abf52e50d2dd6e7f4cf54778f63422e72e63d0480976e22806c90152df242513a9ea9dd
  • SSDEEP 768:kuSOpTPTCFcWUeXa6mo2qAG8V1RpYEcPIazjb9gX3iI5DsK5AZLAx6BDZMx:kuSOpTPOP2W8VDeEha3bqXS4gbWkdMx
  • TLSH
    T10D232B003BE9823BF2BE5F78A8F25145867AF6732603D64A1CC441DB5613BC696426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2