Extracted

• • Target
    507cc71d89e8cfcb988ec7fd013ba7485da898e97d04f73478458787931270f7
  • Size 45KB
  • SHA256 507cc71d89e8cfcb988ec7fd013ba7485da898e97d04f73478458787931270f7
  • MD5 34524c9c3dfb046add19f9707e3e550f
  • SHA1 880dac806942122969553b8199499fa440f5a346
  • SHA512 7f56e4beb528f8dde94c42f86bbb6f578c4e92b981ae3cd0ffdb39cd8401c245d609110f4efa404ec8ee34fe0066b75157353c82176ccda95e7f4379b3a84054
  • SSDEEP 768:UulLJTEs+EgWUKJTGmo2q9kGFZQjB4PIFfzjbogX3ifz93T32FPBDZfx:UulLJTE9X2cqF9Ff3b/XSfz5k5dfx
  • TLSH
    T12C231A003BE8812BF2BE4F7899F26145467AF6733603E54A1CC4519B5723FC69A42AFD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2