Extracted

• • Target
    7549b3fa21b0636789a942384bccacdcb45f5973b4a796e1658fc14748af483f
  • Size 45KB
  • SHA256 7549b3fa21b0636789a942384bccacdcb45f5973b4a796e1658fc14748af483f
  • MD5 1601082844847fa8827bf009690490da
  • SHA1 d42a4793f31948558602ffb9112e341f9ec9373e
  • SHA512 044373b72fd9b289ba9944f19b674922783602e83e764bab2b626bfb44ed17bd1c83e30228b7d7d8ab2308876581d4256672eda6aa896d6a1499ebab78e28b14
  • SSDEEP 768:ku40ZTX3uXTaWUgzW0mo2qw8fBohEa+PIvYjbpgX3ibGgYkDhQZilk3PqPBDZMx:ku40ZTXEb2C4EaHvQbmXSbGWDGolYPqW
  • TLSH
    T164232A003BE8816BF2BE4F7899F26145857AF6A33603D54D1CC451DB4A13FC69A42AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2