Extracted

• • Target
    7677a02479d9c800c94dc1df7e45379a51e8dfddd869ae72e3d4262fb616d851
  • Size 45KB
  • SHA256 7677a02479d9c800c94dc1df7e45379a51e8dfddd869ae72e3d4262fb616d851
  • MD5 ded20c80f6f3a93a4d2cf3dccb6982e0
  • SHA1 42239c53d32b78aa8184740c1a9ddc20a391c6c5
  • SHA512 3a66f81ce8766a48fc54f657335de7ef9c09acaa92439569360b128bc6f78b19c676ec308afab309ce1cf158ccb51d01074f39d5b55f8bf26f56fbf347f61f9b
  • SSDEEP 768:UuKWgSJTwU6NkWUGnaSmo2qAeb30GYjHuPI8zjb1gXQiqHDgEH5BDZcx:UuKWgSJTwRf2uw/383bSXt6cEHndcx
  • TLSH
    T129232A003BE88227F2BE4F786DF26105867AF6637603D64D1CC4519B5A13FC6DA426FA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2