Extracted

• • Target
    72daf03b9e1d6be9e7235e4a86462e4c2fd4d0628666a7418fdf4288b6f378b0
  • Size 45KB
  • SHA256 72daf03b9e1d6be9e7235e4a86462e4c2fd4d0628666a7418fdf4288b6f378b0
  • MD5 59e143204439f15d9c83285288d33943
  • SHA1 dda7b08f7760d66980cfac0c1a9c81cf4a93db65
  • SHA512 0c9391e8c4ae11c21c59573fdeb1abab94785f8c1c1989ca3b43be186ed1d6b67155b65a056dff9f8744bc8b94d289d409abda24e3c3a3625d2f77305ee42209
  • SSDEEP 768:cuR0JTPUYkEWUmjWymo2q1N8V1RpPEcPIMzjb1gX3ikUm0sK77OPwBDZUx:cuR0JTPjY2+8VDZEhM3bSXSkUm0sqEm0
  • TLSH
    T116232B003BE9823BF2BE4F7899F26145867AF2632603D64D1CC451DB5713BC69A42AFD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2