Extracted

• • Target
    70fadd7883d2a45a3769c10b34b31e44bee223ea3b3245f8ab6152c9be9cd117
  • Size 45KB
  • SHA256 70fadd7883d2a45a3769c10b34b31e44bee223ea3b3245f8ab6152c9be9cd117
  • MD5 2ae5d0762ae05d694e7e526d85c6dfdf
  • SHA1 67a9dd5cc5e30dab7a47b4071b04fae8f3577d2b
  • SHA512 a93b4874333910ae880465bb47d8d0d9afbc0a5fe7e93b0b96c6465b493d421e038ca403a7aed7a3f630f09961e4b275c47310c5931b8cfa3d4a4ae2102de54e
  • SSDEEP 768:ku40ZTX3uXTaWUgzW0mo2qwqlsHoPEaMPI1bjbogX3i/ZIGMZYBDZMx:ku40ZTXEb2euuEax1Pb/XS6RedMx
  • TLSH
    T111232A003BE8812BF2BE4FB898F26105867AF6B36603D5492CC451D75713FC69652AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2