Extracted

• • Target
    74a384078197be99ba7c95ab13ce7a0182486b5df496f632d4c56f5e524eb017
  • Size 45KB
  • SHA256 74a384078197be99ba7c95ab13ce7a0182486b5df496f632d4c56f5e524eb017
  • MD5 64a62cf493143161e883a21527d8f9a9
  • SHA1 e7bbae9fb24198aa096998cdeff358c1970cb51a
  • SHA512 005a922328e15c0fb68b0a6b20fdaad8e38d721454efb3718622b645c6541070644cf7525e57c1f4b1f1ff55c60b6d3d2e62af3c66959ee1609e8edf72fbcf49
  • SSDEEP 768:8uUIpT4vvofWWUEXb+Imo2q4UzjHy/aKPIbLjbggX3i7woDm+BSpPho0BDZ0x:8uUIpT4vAj2wnhbfbHXS7HjE/d0x
  • TLSH
    T11A233B003BE8C12BF2BF5B789DF26145467AF5633A03D68D1CC4519B4723BC68A426EE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2