Extracted

• • Target
    71853525edcbc5cd0418f86764327ddc62ccd7ad7862ad4788099d4d6b783a07
  • Size 45KB
  • SHA256 71853525edcbc5cd0418f86764327ddc62ccd7ad7862ad4788099d4d6b783a07
  • MD5 ea770e36db6302fdb76ae594c1016d20
  • SHA1 d8065bd47657990587c50bef6c0666c9953fe4aa
  • SHA512 15e9e449c91e1a750070497f6fe2301dc8a8da251c6b420a14784467c510a558ff0aedd340fb0b7d243694deb45ba2713f43cec89a576572082ece5cde02f25f
  • SSDEEP 768:EufspTfzcR6uWUcb+wmo2q9AcQSCBznqNLPI7zjbQgX3iNVns8t6OS5COBDZsx:EufspTf2g2Jc9UqC73bXXSnnfkOShdsx
  • TLSH
    T1F7231B0037E8C12BF1BE4F7898F26145867AF6636603E54A2CC452DB5713FC69A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2