Extracted

• • Target
    78f6337490f54887e406e830854e11c78214f0aee9dfb77a9cf5af06c1fd6e88
  • Size 45KB
  • SHA256 78f6337490f54887e406e830854e11c78214f0aee9dfb77a9cf5af06c1fd6e88
  • MD5 69ca93cc93d0c10356e5ff68e3c4370c
  • SHA1 6550dd5932a264a95a47e580fc964222fea2b028
  • SHA512 56c8bec22042d7619990f19d29b04de622c0dc4fbe1eece06adab5229aa104e04fb3f38670cb0befce052574063d242d921e99fedc429e6503f84064d411ff63
  • SSDEEP 768:kuSOpTPTCFcWUeXa6mo2qAKQ0e3+/vPPiZPIZzjbmgx3iu2JmKoCjBDZMx:kuSOpTPOP26C32/iWZ3b5xSunKoOdMx
  • TLSH
    T111233B003BE9812BF2BE4F7859F26245867AF6732603D58A1CC441DB5713FC69A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2