Extracted

• • Target
    22b7c063323630788a880e33639adaf2091224c161b501adfcf54aa998468317
  • Size 45KB
  • SHA256 22b7c063323630788a880e33639adaf2091224c161b501adfcf54aa998468317
  • MD5 88edc4507bf5add28d64228826aea316
  • SHA1 a44d28bd4d43942f22a1c29db91e62bbf65180f3
  • SHA512 1b831f74fe2940c5644b0788a24d57a1a20687016888543d338e61c88b5f33e65ffc39fd5e451357cd6d87d2e46ce37c9e60d6eec4856f1fddb6e0557f8d36f4
  • SSDEEP 768:5udApTNctooWUS7C+mo2qtOoRQKIJOPIhzjbAgZ3iHeTfVRRYPwkMsFquKBDZ0x:5udApTNmU2hYxg3h3bnZS+7VRsz3FFUU
  • TLSH
    T117232B0037E8812BF2BE4F78ADF26145867AF2673A03D58E1CC451DB5613FC69A426ED
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2