Extracted

• • Target
    77dd2b99876de0676fd14347766648809eb4565dc3f6aeb9c30623def8c611db
  • Size 45KB
  • SHA256 77dd2b99876de0676fd14347766648809eb4565dc3f6aeb9c30623def8c611db
  • MD5 8bcd4b18ffb40d6c430a844dd53b18e9
  • SHA1 6d3e04a8346363edb01252c43b27cf2fbaf5d135
  • SHA512 c0787b5f9759ae280fe8e45515f3ea415502eea1ad63f8fc8c9a83ae60fb363e3fd9fc32740fe1b8eeae8c90f258d122999fba053ea3ba940629afbf574c2adf
  • SSDEEP 768:ruKQpTA8RXNWU5xFrmo2qru8kLyuObvtkjZPICzjbNgXOi4IHY5Wxf+8DJXnvBDg:ruKQpTAOX2Z8LuyyjWC3baX3PHY5Wpfw
  • TLSH
    T114232B003BE9C12BF2BE4F78A9F26245867AF6632603D5491CC451DB5B13FC68A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2