Extracted

• • Target
    d7f0a20e8ed1c7734855b0212c392705b8a31a781d685f0bf857b5ff5dffc6a4
  • Size 45KB
  • SHA256 d7f0a20e8ed1c7734855b0212c392705b8a31a781d685f0bf857b5ff5dffc6a4
  • MD5 404d8c7eabe3d5d71199f6c344fe1b53
  • SHA1 6ec83c342add807240275099685a675249606c5f
  • SHA512 4e91ab4e1edfbccdff902b9aa09a927c29429ec94ecc0308bcfcd6553a392c030c9b22585a4b4be527408ae0a02d9218258fde8e3f5fd086ad0b33717b28b5a2
  • SSDEEP 768:Iu5KkpTsU6Q8WU+xjamo2q1c1GtCV+JtHuPIXzjbggX3ifZzHL3JSBDZLx:Iu5KkpTsx/2X1TM3X3bHXSfFL3edLx
  • TLSH
    T155232B003BE9812BF1BE4F789DF26145867AF2672603D64D2CC442D75623BC6DA42AFD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2