Extracted

• • Target
    741c561a9c3aba296510ff0bf1b13a6f9b1765f66f2d6afb63d4e23f31fdd3aa
  • Size 45KB
  • SHA256 741c561a9c3aba296510ff0bf1b13a6f9b1765f66f2d6afb63d4e23f31fdd3aa
  • MD5 18a8803b8df070625009ec45e68b3cfd
  • SHA1 99ed66c397c72b643a7fd0c29c51ca9e74f2bae3
  • SHA512 d9aad5b8f683e65827c3ba2b10f910b1a119b96cc6cb4dc3156ff9a0b634b0ef8d6256177f4bf13d9463bd277acdb101a1ee476fa3017cb1c02a07ab0910d882
  • SSDEEP 768:0u2vpTD4U2ieWUsqfAmo2qjL6acyPzlOPIBzjbGg93i5bpMX5d7Llhxs2mYwUOBM:0u2vpTDe+2Q6VC3B3bZ9S5pMXz7rAd8x
  • TLSH
    T1B8233B003BE8812BF2BE4F789DF26145867AF6633603D6491CC452D75623FC28A526FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2