Extracted

• • Target
    22b56d81671f35a635d091654f2097f74f25cd180f4c802151469b384a028e48
  • Size 45KB
  • SHA256 22b56d81671f35a635d091654f2097f74f25cd180f4c802151469b384a028e48
  • MD5 7e9163498cfc2342fcb4643ce12170d7
  • SHA1 74f2c25f0a4b18cc68f22586f75dfd5b67f0f214
  • SHA512 0a3fa99442c702a6c9e6f073707077b9cab9a88e390f346f6fa002b4f019ea0bb6d1c98f574bf89b917192566bfac9ce412acb17a5a521fe25fdc458492f5183
  • SSDEEP 768:7uCIJTQc5fVWUhxlDmo2qrmxGZGP9HuPItzjbGg/3iNmaFemqgcofoBDZkx:7uCIJTQmX2ZGa3t3bZ/S4+nqpdkx
  • TLSH
    T124232A003BE9812BF2BE4FB8A9F26105867AF5637603D54D1CC441DB5623FC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2