Extracted

• • Target
    70567673fce27585a2757c949e2d8130ee6123b8c6507daf5d157c8d916826a7
  • Size 45KB
  • SHA256 70567673fce27585a2757c949e2d8130ee6123b8c6507daf5d157c8d916826a7
  • MD5 76dbac0d73ad34c3afcc2fb5044e5e92
  • SHA1 321aa9f68efb51f178988d67d52d61045c9c7669
  • SHA512 eb48508ff72f7c759620a5578ad320e8dec72f45d70173fe042055dd3f4cffb863d927795b9de099592cdd580fa4d21fcba75ff9bedfa5880611dbb26fb76ca3
  • SSDEEP 768:8uuSpTg7GBoWUSH6+mo2qY7COtTMtPIhzjbfgX3i9V37B4QQFZBDZ0x:8uuSpTgyf2DRvh3boXSbPQxd0x
  • TLSH
    T179231B0037D8812BF2BE5B7899F26145867AF2673603D58E2CC441DB5A13FC69A427FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2