Extracted

• • Target
    adf7727de0c1efea05d77fbc49b53379327f72422e7f747d4428dd3e2402fffe
  • Size 45KB
  • SHA256 adf7727de0c1efea05d77fbc49b53379327f72422e7f747d4428dd3e2402fffe
  • MD5 295879eb9b79c07b5624315932ecae2f
  • SHA1 8bf1cb2cfe6f012387281202483ec417a1669e30
  • SHA512 056bcdd200f6661f4d0292495f22c25512028e2066c156e32bda4bd504f59e05840c2f8b643fffbf1d0831d728ef3b527b705780e4b6b3da6b7dd7b29a5e4dcb
  • SSDEEP 768:0uAVhJTDEQAQWUaDyzWmo2q7h/cYssPJZOPIcvzjbOgXpivRH0ypaPJmdddBDZ8x:0ushJTDXgH20MIf3cv3bxXYvx0wMJmfY
  • TLSH
    T1A5231B003BE8812BF2BE4F789CF26145867EB5637603E68E1C8451D75623FC68A526FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2