Extracted

• • Target
    73d8bb1feaafaa1cdd8cd96ed22f82a7144ec6bcf44a18680568041dfabe49f2
  • Size 45KB
  • SHA256 73d8bb1feaafaa1cdd8cd96ed22f82a7144ec6bcf44a18680568041dfabe49f2
  • MD5 57c0ebbdbeb1305d9401e7ce776cdc7f
  • SHA1 0f1d0556189c77a7fb570f6e07af53b4a49c8df4
  • SHA512 530935cab42c36a7d186201966f83a80a4354095698cfc4792e046de64512af9aaf2800a0e454ca87c32d825f8c55c43c4a44d5bb717ab9d74d0904d974423b2
  • SSDEEP 768:MuBGJTP0BQ0UWUWHaimo2qVj0b3NEAteiZPISzjbyg33iof591Ul3SdMBW2BDZEx:MuBGJTPho2/3ehiWS3b13SQ591U0uBWD
  • TLSH
    T192231A0037E8C12BF2BE4F78A9F26145867AF6632603D5491CC451DB5A23FC69A436FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2