Extracted

• • Target
    737607789afc6d65f41dc0609aaaa84bce339f58fed065c00cb1d2076966add8
  • Size 45KB
  • SHA256 737607789afc6d65f41dc0609aaaa84bce339f58fed065c00cb1d2076966add8
  • MD5 98e3d073fac323d4d9f5b624ddbe0518
  • SHA1 6967fd5785c88a704638078510c29ccb2d34b8df
  • SHA512 b07797042989de87fbb239e64f539d830fb230ee3a5498f844a7a0aabe96215f0ce1cd940796f43ee89d3dce53c81009e2515042d83972e90f8584973632bbb4
  • SSDEEP 768:8uuSpTg7GBoWUSH6+mo2qYJCHyTtUPIRzjbvgX3iKWePrKSDMiBDZ0x:8uuSpTgyf2RnjR3bYXSYjxDtd0x
  • TLSH
    T104232B003BE9822BF2BE4F78ACF26145867AF6733603D58D2CC4419B5613BC696526FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2