Extracted

• • Target
    76f5ddf0d79b9f903af06eff0f362fde0f1e30a0e27c9caa5edd3ac08019fa0c
  • Size 45KB
  • SHA256 76f5ddf0d79b9f903af06eff0f362fde0f1e30a0e27c9caa5edd3ac08019fa0c
  • MD5 1715920157385a59b2965de5a9cbb144
  • SHA1 c412163a2af9b7d9acaffdbba2161a7681a78250
  • SHA512 e9d8dfe6f3a1a8fcdb86f37ef81e543e7b9d773f61e9f227f085b485b3d5425174533cce04ddb3d1e5916c0daa49be349168953f1ca1ce76c59f99c8e779a310
  • SSDEEP 768:8uuSpTg7GBoWUSH6+mo2qYCDEbHB0jrOPI/izjbVgX3iZGGYw49Ab+BDZ0x:8uuSpTgyf2qySf3/i3byXScGYlAkd0x
  • TLSH
    T13D2308003BE8C12BF27E4F7899F26145867AF6633603E54D1CC4529B5623FC59A42AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2