Extracted

• • Target
    079ef8e789aa1438c64802f8ae1462de77fbfe741af1722d76e665d87854061a
  • Size 45KB
  • SHA256 079ef8e789aa1438c64802f8ae1462de77fbfe741af1722d76e665d87854061a
  • MD5 47287eda9fbbec8c498a7be7f1350d18
  • SHA1 9bc962c747ff8eb5190a974228490b748083be8b
  • SHA512 4eb3307c1136381dc96f6adf6de21289d67eec7b51f743239529f0ad0b31dd5c42e52dae0661be1b3021313fd4e44667e2cf1b34f28ac43336598b1a3e6800dd
  • SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFOeeXK5oibbb6TN8/nPI6WzjbSgX3iy/gFl8Pd3Rhwm:MuLAZTnbg2aeEqTNKA6W3bVXSiC8PdB/
  • TLSH
    T1C5231A003BE8C12BF2BF4F78ACF26145867AF6732603D58A1CC4519B1713BC686426EE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2