Extracted

• • Target
    d724ed4df6ab27f77f02834f3743e032723aed5ed22fdfbc37280492bdc8ec7b
  • Size 45KB
  • SHA256 d724ed4df6ab27f77f02834f3743e032723aed5ed22fdfbc37280492bdc8ec7b
  • MD5 40c31b524570d102fadcddcfe183493f
  • SHA1 d7a5981704b9a3fef539d380b1515f6c1b6d0863
  • SHA512 9717ca664d9fa098a20b8aa743e7e269bb87fb04d876944af44690f49acef442e27506bb67824c2aecd1d5b28cddbf589e0d948087eb1f50099e39afba7903f0
  • SSDEEP 768:8uuSpTg7GBoWUSH6+mo2qYnZbyDMgPItXxjbYgX3im1jYsZNKe8ANzBDZ0x:8uuSpTgyf2hmEtXhbPXS9e84d0x
  • TLSH
    T13B232A0037E8812BF2BE4F78A9F26145867AF6633603D58E1CC451DB5623FC69A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2