Extracted

• • Target
    72edbb03b5238b8a7a09ad975e41b3d1ef23745e447dfdde6446a7b8c01622aa
  • Size 45KB
  • SHA256 72edbb03b5238b8a7a09ad975e41b3d1ef23745e447dfdde6446a7b8c01622aa
  • MD5 febfd06c4c15c90a4530d4aa1fea36a0
  • SHA1 f26df7e4857f3e525002d1e761b855c66b15628c
  • SHA512 03f4be56d35caf1fefa660ec7891a8f9e9fd491e5daa1a17ae5925160b7fa637c7cd2724688d1ecf6e1d81a787bbd55c0ed4381d61edc939b9fd6dd5800cb537
  • SSDEEP 768:5uSy6pTpwrSWWUE3/WImo2qNrITnyfaaPI5zjbcgX3imgX9T4ThqblxBDZ0x:5uSy6pTpoo2oEh53bzXSmoTkhqblPd0x
  • TLSH
    T1CF231B003BE9C12BF2BE4F7899F26145867AF6632A03D6491CC412DB5713FC58A526FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2