Extracted

• • Target
    b79c2e4523c12354086b281a37e35e5a750dd9307c40872c6d0f7f08fab8bd5c
  • Size 45KB
  • SHA256 b79c2e4523c12354086b281a37e35e5a750dd9307c40872c6d0f7f08fab8bd5c
  • MD5 2400f28a34cafd26f5fc05d5b0fd5d45
  • SHA1 739ad411eef6580fa4c1f584610db7f395dde069
  • SHA512 379f4cd0b9aba44639d1489f68c413f53154253b33ce714666f803330af5ae26a0af0151d553c7d0f51e7ccec1a459fc24780ec0302d72e673be016aaa0d1940
  • SSDEEP 768:ku40ZTX3uXTaWUgzW0mo2qwg3xY6AZOOPILzjbDg43izR/zTxbG8aBEBDZMx:ku40ZTXEb2culO3L3bc4SzRJ0ydMx
  • TLSH
    T108231A003BE8812BF2BE4F78ADF26145467AF6633603D64A1CC451DB5613FC68A526FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2