Extracted

• • Target
    764d27fb14c1d8b28d37dc340f76a9493ffe5b593240b0043d875a1be5e5162a
  • Size 45KB
  • SHA256 764d27fb14c1d8b28d37dc340f76a9493ffe5b593240b0043d875a1be5e5162a
  • MD5 46044f03f47d8be47e2e7e558017ef93
  • SHA1 53a9a0de39e0476262e72c2e9d3f3b73e7b0ef41
  • SHA512 73c0eefe0964b06ca7daeb5e2e696b0c641cd7f1c744ef5b03883ae52a7cc84f2f5f188d1390a2a566c459cf2d142cb4db7c60b9fc50a01df4ee5a2395ab3030
  • SSDEEP 768:MudApTNctooWUS7C+mo2qtsGFZQjB4PIFfzjb+gX3iFyN0oV0pDBDZIx:MudApTNmU2kqF9Ff3bBXSFyN0o6ndIx
  • TLSH
    T1FF231A003BE8812BF2BE4F7899F26145467EF6733603D9491CC452DB5623BC69A42AED
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2