Extracted

• • Target
    75ebcb49a61b4ba758d1664bcbf36c4fe6c7ce6d2f1e644fb333e026fc2950e7
  • Size 45KB
  • SHA256 75ebcb49a61b4ba758d1664bcbf36c4fe6c7ce6d2f1e644fb333e026fc2950e7
  • MD5 6db1986552180158b8582004cb419e1d
  • SHA1 58c81a054a2ca73d1e89018d9b996ee258aab1de
  • SHA512 6b7295f4b42de5f69f893df942f487ae53f6c993fd3ab960c78d2d2e5e62690cedde6ac8507718acc8a5116db18c9718d8e1ea59ab601c3c06c90ce74b441d42
  • SSDEEP 768:8uUIpT4vvofWWUEXb+Imo2q4zSzEynzuOPIazjbAgXHiSlXfdhG3Un0/ugWsLGrW:8uUIpT4vAj2nSIh3a3bnXCSdG3U0mzwZ
  • TLSH
    T1E6232B003BE9C13BF2BE5F78A9F26105867AF2636603D6491CC4519B1723FC68A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2