Extracted

• • Target
    78415c082a6f6767f05c611b0b812a5ca030c3ff70bdd520d055d785cb94c774
  • Size 45KB
  • SHA256 78415c082a6f6767f05c611b0b812a5ca030c3ff70bdd520d055d785cb94c774
  • MD5 fe3f440a366a418c669620a1466d94c4
  • SHA1 15cce6e3c363a187eb3f0a805f077ecd970cc8ae
  • SHA512 38313f75c49a804bcaf020c768cf255315eb81974718917836a9c297cf402df9781e1d057952dee5dd3926b9d6b2072da8ed7f8d546cb2e0d380b64004e50128
  • SSDEEP 768:8uuSpTg7GBoWUSH6+mo2qYEZoQTMtPI4tjb6gX3iPX7jivbg5jTjBDZ0x:8uuSpTgyf2sL34lbtXSXsUd0x
  • TLSH
    T1B2232B003BE98127F2BE4B78A9F26145867AF5673603D58E2CC441DB5613FC58A42BFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2