Extracted

• • Target
    722a47d3677e949d544d42323badb6a1035c2837a980385c3577e2e47e3b8593
  • Size 45KB
  • SHA256 722a47d3677e949d544d42323badb6a1035c2837a980385c3577e2e47e3b8593
  • MD5 53fd995e7960b7c1879549bb3ce4affb
  • SHA1 767e266bc201071f7e1ed9799b001b4bb219daeb
  • SHA512 8ab54de03cbd2a57eddd7ae27bf128eca6ec8f20fca6f237ea4d4078b81d5da72f7543fb51231b8ade28baba472de51ebfea7f3e97a31ef21450ce778585bd0c
  • SSDEEP 768:cuq04JTLcsP8EWUmOTymo2qAu0ewtDc30oiZPI/zjbggX3i570RQGGY6BDZUx:cuqNJTLr62gwR2iW/3bHXS5EQ/YkdUx
  • TLSH
    T18C231A003BE9812BF2BE4F7859F26145867AF6632603D54A1CC452DB5713FC68A43AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2