Extracted

• • Target
    77fea5e086440f8887ba0419231099dbadff3a120619b34bf6e657634e8a6231
  • Size 45KB
  • SHA256 77fea5e086440f8887ba0419231099dbadff3a120619b34bf6e657634e8a6231
  • MD5 91405757d4ad14c841fce45e712b7343
  • SHA1 f3ba5dcceb996812df08fbad365066af5682736a
  • SHA512 f1f16a118823363bc7489202ee85d6cc4b7d4963c6c85a643453ef4f08150d64f697a1913964ea196a888b9eebe67b07882f7d1c5956e43a2dd87aa122562cd3
  • SSDEEP 768:MuBGJTP0BQ0UWUWHaimo2qVyLiE0yFjrdjYkk8PIuyjbNgX3iRynsY+CKaPBDZEx:MuBGJTPho2/LBXQBuebaXS0ZuWdEx
  • TLSH
    T128231A0037E9812BF2BE4F7899F26245867AF5632603D5491CC451DB5B23BC6CA43AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2