Extracted

• • Target
    73ab3f96e74d1d6dbce9b7931d379a01037790cbe408872697b632bd170bce30
  • Size 45KB
  • SHA256 73ab3f96e74d1d6dbce9b7931d379a01037790cbe408872697b632bd170bce30
  • MD5 f40b3e5c9f3488dba522831841548a5a
  • SHA1 20a0159275bf6532e5b0480d5f296ba097854af9
  • SHA512 9577d06aa8b53d5112987feb8a0378666986125669ef69c763c1264e8eb32585342dfba56af49d1394180b5df5f1c8aae64924074810f92a7fcbf734bf75ab8b
  • SSDEEP 768:cuq04JTLcsP8EWUmOTymo2qAYQ0u3+/vPPjZPI3zjbZgE3iNyuP9eLe2m6dBDZUx:cuqNJTLr62Ii32/jW33b2ESYen2tdUx
  • TLSH
    T141233B003BE8812BF2BE4F74A9F26245867EF6672603D5491CC451DB5713FC68A42AEE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2