Extracted

• • Target
    a786daad22990f7dc76b85e5acef8a656fa1d7f999f120c36a7577703edaf784
  • Size 45KB
  • SHA256 a786daad22990f7dc76b85e5acef8a656fa1d7f999f120c36a7577703edaf784
  • MD5 748a67e4bb9506a6c8e41dd13dce0899
  • SHA1 07a54306b6effda5aa158e53863c787add830d9c
  • SHA512 c61909ede4c4cf8b902e7a6ea698da40300d515f68855976050a9fff102e1606682a0710a3d19cd576215ac9be7e5cf8547aa5f64916e485346a1e5d9acf0d4a
  • SSDEEP 768:MuBGJTP0BQ0UWUWHaimo2qVJpt0CCM+d4CvS8PIk6jbNgX3iqBeqQm95RofBDZEx:MuBGJTPho2Q/CFWBkWbaXSAFQm97opdG
  • TLSH
    T191232A0037E9812BF2BF4F746DF26245867AF6632603D5491CC451DB5623FC68A43AEA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2