Extracted

• • Target
    772559c9091894928d6d4e5e531f5fb5f56f049906781e79483ecece208661ef
  • Size 45KB
  • SHA256 772559c9091894928d6d4e5e531f5fb5f56f049906781e79483ecece208661ef
  • MD5 772b6b5161146923d6ede9bec81b2ebc
  • SHA1 a1b981a81671b7a18b6d7b7aa24496a4db00f899
  • SHA512 d4dd6c470c656084cfd028e4c763e685a720f1fa28709c5bdf3dd7ad21f34223a81e66b7de87f7f186d250fb5ee0a4284016f31f0d5d79786a64f9f1e5341d7b
  • SSDEEP 768:cu7m/5THrq+CWUoDuMmo2qFN3HO4SNMOPI0+zjb4g/3i84mr1DdjlVj8OVBDZUx:cu7e5TH2A2s+JM30+3bv/SOPjlVgO7dW
  • TLSH
    T1F7232A003BE8822BF2BE8B7899F25145867AF5637603D54E1CC451DB4A13FC6DA426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2