Extracted

• • Target
    7356b512171a16acb3ea7acad36ff20dcc8bc25d9e5b8aacf62db045814d8132
  • Size 45KB
  • SHA256 7356b512171a16acb3ea7acad36ff20dcc8bc25d9e5b8aacf62db045814d8132
  • MD5 745546424cbe4faf26e5c5ac2de1eb08
  • SHA1 1cbcece3b4e643bea03c0e484110cf6570c4ff6f
  • SHA512 a971b56b8c2b5dd2acae5ebcfaa6dd5dae324ae19b36252bf5837db0d09b34fa9b338ad2b89f4a7b5df86848915a965af050a2bdda6cfb98d2a778ebbc668382
  • SSDEEP 768:EufspTfzcR6uWUcb+wmo2q98zjHy/aKPIbsjbZgX3iV/8Y+Dau2uLLuvBDZsx:EufspTf2g23nhbcb2XSV/8DjHuZdsx
  • TLSH
    T102232B0037E9C127F2BE5F78ADF26145467AB6633603D6891CC4119B5623FC68A42AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2