Extracted

• • Target
    78a018884d69be4169a4df3943f5e5153543731f8cfc27b7eb66c8b1fef06e0b
  • Size 45KB
  • SHA256 78a018884d69be4169a4df3943f5e5153543731f8cfc27b7eb66c8b1fef06e0b
  • MD5 183f70f30c8b893e31cec197c1aef8e1
  • SHA1 154624283537e14cea77ac2e77b6638cfe52ab1b
  • SHA512 289d7fe50c000e881f7cecb08a9642e3b66d1b7bc99d68d3790d20f7114c358e0ed2ac6dd8c31447f66e2af6dee137e5c8357b3d4c76362b294d5ae397293fb2
  • SSDEEP 768:cuR0JTPUYkEWUmjWymo2q1Z0ewtDcy0oiZPIHzjbKgX3i8yjdZnBDZUx:cuR0JTPjY2AwRPiWH3bdXSPj5dUx
  • TLSH
    T1B5231B003BE9C12BF2BE4F7899F26145867AF6632603D5891CC451DB4723FC69A43AED
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2