Extracted

• • Target
    c71e79aa93f20d8191ff25e09c21178e658396e6e282498d9c400a2461887f1b
  • Size 45KB
  • SHA256 c71e79aa93f20d8191ff25e09c21178e658396e6e282498d9c400a2461887f1b
  • MD5 8d958a2a68071513ef922a6f2e3c12df
  • SHA1 2e6d869150522b02d52e0e9c3e92259e231a86ed
  • SHA512 33cdd3a3967262d51ef85be6b235a7cbfe3742af758dfcd49b5091c97f6c3b6c07d407858cefd5e7fa64793a59908485915ad28ec6a4c86177a4cf4a70987fee
  • SSDEEP 768:cu7m/5THrq+CWUoDuMmo2qFJlpO40rMOPI0FzjbtgC3iCcIYQtOW0BDZUx:cu7e5TH2A2QyZM30F3b6CS3WtOjdUx
  • TLSH
    T1E0232B003BE8812BF2BE4B789DF26145867AF6736603D54A1CC452DB4713FC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2