Extracted

• • Target
    b781e37f17a7fa677bc4c97bffa5e193d34cce44d84a2a7c3af9c93eb7b6bc93
  • Size 45KB
  • SHA256 b781e37f17a7fa677bc4c97bffa5e193d34cce44d84a2a7c3af9c93eb7b6bc93
  • MD5 06b49af5385e5cd3cdbf4d863d4a7592
  • SHA1 845c95f8ba7e0c6b59acc067e5ba5697016608ef
  • SHA512 b0f9b9b353894fb333056660b63f15aedf06b9e9b0fb02aa56496498b34a9bedaee404db33a56d9d37a7f2715d8ad466fff0484cdbeabfeb1d1edb20744049ab
  • SSDEEP 768:EulCJTHESwgWUK3aGmo2q9ah5BewwbOPIMQzjb0gXzi5+xDK9MDtsBDZsx:EulCJTHl4219F23MQ3bbXuwfYdsx
  • TLSH
    T174231A003BE8C12BF2BE4B78ACF25145867AF6673603D68A1CC451DB5613FC69642AFD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2