Extracted

• • Target
    71944389a9e83a88bc114d0c6282ebe974032e2e87c312ed64b123d608a9bed3
  • Size 45KB
  • SHA256 71944389a9e83a88bc114d0c6282ebe974032e2e87c312ed64b123d608a9bed3
  • MD5 c29022a3dda59adbe26691cf56c1967b
  • SHA1 2e55cacc4f850c89fa7a2796da480c37e06637ab
  • SHA512 ced70b5568a5e9b318216321e2f681a02a7180a0c3b438d64f3ab0366abbf5a9cbbdac9d8ad78c0f92b5c90cf68c4365b4c664035abb85a55357ac7eafe5bc16
  • SSDEEP 768:5udApTNctooWUS7C+mo2qthRzMwnOPIZzjbUgX3iQ5DZhTaILBDZ0x:5udApTNmU2qA+3Z3b7XSk/7dd0x
  • TLSH
    T198232B0037E8812BF2BE5F78A9F26145867EF2673603D58E1CC4519B4613BC6CA526FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2