Extracted

• • Target
    dd558d7b7074e349a7a79c422818a97cf25ddb1b59bd9c73ad4f812679a74049
  • Size 45KB
  • SHA256 dd558d7b7074e349a7a79c422818a97cf25ddb1b59bd9c73ad4f812679a74049
  • MD5 225d17869768d7899f2d489e03d546bd
  • SHA1 509a0645c8a67595b255936ea66c8363555bb984
  • SHA512 713e1ba35ec2e65b8b871e575b801846aa256909f2c55d3b92d87df56fb2dcbdc3716b4be8a16f147dfe40536429f16e81a1acec170a6c1cab2771f0b4926b32
  • SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFEfBohEa+PIvtjbWgX3iIskHKynGF1UBDZEx:MuLAZTnbg2Z4EaHvlbJXS6qyn/dEx
  • TLSH
    T1A2232B003BE88267F2BE5F7898F26145867AF6B33603D6491CC411D75B13FC68A526FA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2