Extracted

• • Target
    7045cbfdcbb92c07be9bc188ba69c614be3eefa4c52b0308410aaa8367e16b5e
  • Size 45KB
  • SHA256 7045cbfdcbb92c07be9bc188ba69c614be3eefa4c52b0308410aaa8367e16b5e
  • MD5 1d2efbf191daad7a3f61708e92f726d4
  • SHA1 bbab5f9183add3a409ee1d6d2b434ba5e68264aa
  • SHA512 d8cee1849e562330bca4f185e9e4677bef53327d1d6f78f829d49e6e18a2caa597991289d3c879eb82a97f99a323152da578722c4de5610f8801f095c8e9dea0
  • SSDEEP 768:wuZ8pT1Uu4/cWUeT66mo2q1V8V1RpPEcPIMzjbogX3iCvZlefdHKLcRO8/VTLBDo:wuZ8pT1tc2W8VDZEhM3b/XSs4RrdMx
  • TLSH
    T141232B103BE9813BF2BE4F78A8F26145867AF2633603D64D1CC451975613FC68A42AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2