Extracted

• • Target
    7748ba6c69e0d8369fb6d4aad325f85c53d69513cbfed2eab23135538384f569
  • Size 45KB
  • SHA256 7748ba6c69e0d8369fb6d4aad325f85c53d69513cbfed2eab23135538384f569
  • MD5 bf20f2467af41d3a14b0520d85ff0688
  • SHA1 15e1962a3b323e8028b63eefa7d504cba0cd5834
  • SHA512 f3a2e012d5886767e961a7fcb88bb5982e96f599582396ed0df9c01e634d018fce7dc70b77ab6f21a092ae6fedae628b78034351a5662889531e35c74b856551
  • SSDEEP 768:wuDWZTpw7bmaWUg3gSk0mo2qly/l3u40cMOPI0azjbmgXti5VKY1iKUwSSBDZMx:wuDWZTpMZSB2bk+M30a3b5Xc5V9SmdMx
  • TLSH
    T129232A003BE8C12BF2BE5F78A8F26145467AE2777603D64E1CC451DB4A13BC69A425FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2