Extracted

• • Target
    70e4db770725bfbb2b591c0f39a3a0c1a2d2d52eca8aae33ef018ab58a43cbed
  • Size 45KB
  • SHA256 70e4db770725bfbb2b591c0f39a3a0c1a2d2d52eca8aae33ef018ab58a43cbed
  • MD5 d138966c59db2aefc6672172a26ea29a
  • SHA1 3d8cd7c3e7cb6f80991430d5cbeb1659d593b1e7
  • SHA512 689c94eccccafebe89ce85295b47f2dfc5c4baefb8afd7138891992bd20003a19acea473721b292ef64ea4a3340fc8f49938aa8dd29f9dce38cc2f2cc334fbca
  • SSDEEP 768:MuBGJTP0BQ0UWUWHaimo2qVE10CnMQRPn98PIQHjbcgX3ilhBld2yvVAaSQG2SBE:MuBGJTPho2dtnbvBQDbzXStldtvV/SPe
  • TLSH
    T138232A003BE8812BF2BE4B74ADF26145867AB6733603D54D1CC451DB5713BC68A52AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2