Extracted

• • Target
    579703d5faeb9d91d51a8d3d85923d8476eaa9ab8b7418a20b1c7ea712c08294
  • Size 45KB
  • SHA256 579703d5faeb9d91d51a8d3d85923d8476eaa9ab8b7418a20b1c7ea712c08294
  • MD5 3a97ec24839e51802d1d797ab9dab2b0
  • SHA1 306ea4e25dc583b7e70753aaba7046d8858710de
  • SHA512 567b4449576ce239dcc71a07f001628d3a22953129a059f7311668893879e37fb1ceaacdbff9512ff88906504bffd03a95659f8a66b215de17856ec2048e49e1
  • SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFEfBohEaEPIQgjbrgX3ivzQtGMYbYyYEdYK8BDZEx:MuLAZTnbg2Z4EapQIbUXS76OdYZdEx
  • TLSH
    T174232B003BE88227F2BE4F78ADF26145867AF6736603D6491CC412DB5713FC69A426F9
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2