Extracted

• • Target
    74dae625af3b48f2ee06d8da945eb807f16f0ad7235e967326f074dd87e52c86
  • Size 45KB
  • SHA256 74dae625af3b48f2ee06d8da945eb807f16f0ad7235e967326f074dd87e52c86
  • MD5 e6022d1357112518156a218ad89abb2d
  • SHA1 2728fb930cb69ac66cd4559c18f3e0bf4b6879e3
  • SHA512 dab6b02e75191a00d7925e2d0e89d01ede07d1c41f93a5148701af60d3fc25f6913ae69de3095bdb170d00cb9ad8dcce686e88b73a2427cc53d2a6989273aa11
  • SSDEEP 768:0u1YJTHwAUgQWUaT2Wmo2q9JW8aIXOPIKzjbTgM3i4bA16B0V3rPBDZ8x:0u1YJTHcw2lFu3K3bMMSp8+tr5d8x
  • TLSH
    T13F232B003BE8812BF2BE4F789DF26145867AF6673603E54A1CC451DB4613FC6DA426EE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2