Extracted

• • Target
    71edccc66dad0e11ed72623b9322a29d4e0ad2fa630173036517156122299de4
  • Size 45KB
  • SHA256 71edccc66dad0e11ed72623b9322a29d4e0ad2fa630173036517156122299de4
  • MD5 d983a36d51b5989284755c10690ba136
  • SHA1 4fd5e62674e148baa1457a96faf6a55eadacc03f
  • SHA512 3d4430a7699d2ba25e2939ecd596c1b677e22ee0b4281c1541ab466d59fcf068d81ee329aa22757b6520d05bb8e98aab1481c8b181a8c97be58ec3e15b3bc4a8
  • SSDEEP 768:EufspTfzcR6uWUcb+wmo2q9L9YqPq3hOPIezjbegX3i3b0RjqzsY3cBDZsx:EufspTf2g2Gaqq3e3bhXS3oi36dsx
  • TLSH
    T137232A003BE9C12BF2BE5FB89DF26145467AB6633603D64A1CC451DB1713BC68A42AFD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2