Extracted

• • Target
    74b98ef8c63d78a31792a38d5e2a77dbd6f5611ac9638e79ba7dda254479e606
  • Size 45KB
  • SHA256 74b98ef8c63d78a31792a38d5e2a77dbd6f5611ac9638e79ba7dda254479e606
  • MD5 807985c52660a048b8b21eed1f955681
  • SHA1 ed6ad95a45e1c3cef2fe2d930c42e9f42b5e1571
  • SHA512 6e339f8da1ed14185b8c36f07746132e6df756fe26ec20e0d3c8bbd78e6367e8ba2fd7492482267f48867fcd6eed16085333a0ff255b2de30b6bf6b072eb0f93
  • SSDEEP 768:4uLZZTUAoOSWUYZL8mo2qF5hk6K7OOPIzzjbygV3iHx+JvrU1LMuBDZbx:4uLZZTUTn2g6VO3z3b1VSR+NUhtdbx
  • TLSH
    T128232A003BE8812BF2BE4F789DF262454A7AF5A72603D58A1CC451974713FC6DA426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2