Extracted

• • Target
    710542208f3a4ac4c434d04892581cc635061516bcccf85823c09179cd74c2b0
  • Size 45KB
  • SHA256 710542208f3a4ac4c434d04892581cc635061516bcccf85823c09179cd74c2b0
  • MD5 ce9d548d11a3156d1f27cb5cc81fc225
  • SHA1 61658e9a18ecbbff6fd9a373c41e9e0600226b67
  • SHA512 595d8b8bd4d673df48a35bb14ca86d7bb48c863a3552d883c4a028c40ed30a30d01cf09ade20397c18d46a674a1279db8952582ba8236ff8debe82417b6b1fed
  • SSDEEP 768:kuSOpTPTCFcWUeXa6mo2qA70ewUkA1MiZPI7zjbPgu3imbogU0mmdqLaaMuBDZMx:kuSOpTPOP2/wvDiW73b4uShNMgdMx
  • TLSH
    T1B7231B003BE9822BF27E4F74A9F26145867AF6632603D54A1CC451DB5713FC68A43AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2