Extracted

• • Target
    2742a7888b99913dc7ca670cae4e28d229b0e0a95e52b0ee30040c8863d98f74
  • Size 45KB
  • SHA256 2742a7888b99913dc7ca670cae4e28d229b0e0a95e52b0ee30040c8863d98f74
  • MD5 d43f34215f2b8dea853ff019a490bd06
  • SHA1 177d3ae57cd5040c396d0bd7e42a4321037323d2
  • SHA512 d06a49285bd34a1ac604caf1369815f014f2bbc35ad46737a645eb7d78c1ec75c04a21b8800e883d5dfbcde4e99968569c90e37bc13dc2978a9140c8e4f0e8da
  • SSDEEP 768:wuDWZTpw7bmaWUg3gSk0mo2qlneeXKGoibbb6tN8/nPI6DzjbNgX3iZnjpAgG6B8:wuDWZTpMZSB2DeDqtNKA6D3baXSZnLGH
  • TLSH
    T1A6231B003BE8C12BF1BF4F7899F26145867AE2737603D58A1CC451DB5B13BC69642AEE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2