Extracted

• • Target
    78a88f43a90d3f7acee4886208e80ef2158b4d60e8fd07cc841c34084fef0905
  • Size 45KB
  • SHA256 78a88f43a90d3f7acee4886208e80ef2158b4d60e8fd07cc841c34084fef0905
  • MD5 54b7faa21a225cbf1ac3be368f95f913
  • SHA1 c3872800effe40a2b4c2cc38ca8105e86b3bef0d
  • SHA512 43843097346510000307dc16d64530a57388e5be1de05571986cad1a71335916ad618482368ef00cb0fda1dab7297bf0e5591fc5eb7496a77c213f0bf4b652b7
  • SSDEEP 768:cu6RaepTPYzbs8WU+Xaamo2q1HqJaxjwHuPIPzjbBg0D3iNj2EboD11xeJk65d72:cu6YepTPso2S3+3P3bu2SNa9D3xeJk6i
  • TLSH
    T1412319003BE8812BF2BF4BB8A8F25145467AF1637603D6492CC452DB1723FC68A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2