Extracted

• • Target
    f71f742b2abde218117737818bb44797b2cf63efaf6ebb668bd9978ebf99cac7
  • Size 45KB
  • SHA256 f71f742b2abde218117737818bb44797b2cf63efaf6ebb668bd9978ebf99cac7
  • MD5 42154ebe47ce7c9acf856bed84641acb
  • SHA1 052c60e40ee881d8719227f8ca0b127e5f751a48
  • SHA512 16d9f9bcdc214b8cacdf9907b48d61468431a8a02550c7ba6b7ae993447a9fbd2848615db619af6656b801768e231db5a30f4d093468252ba535db06f23262ed
  • SSDEEP 768:ku40ZTX3uXTaWUgzW0mo2qwP3Fo9EaOPIFzjbYgX3i3/BIQMcWLFwsB7eKBDZMx:ku40ZTXEb258Ea3F3bPXSPB3McWL6w72
  • TLSH
    T189232A003BE8816BF2BE4F7899F26145867EF5A32603D68D1CC441DB5713FC69A426FA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2