Extracted

• • Target
    754750dbf4c2362488999e428c8cf933f4989aebcbf68261727058300cf9fe03
  • Size 45KB
  • SHA256 754750dbf4c2362488999e428c8cf933f4989aebcbf68261727058300cf9fe03
  • MD5 bc2a235640b01736158f169e157b0e4a
  • SHA1 f5a7bc418bbefca1ff832cd08969b4eaf5dbfe21
  • SHA512 c315537c32db3c163a63c6cfb3b5c83f9c3a2831d5a74181476003eb50b7220e22e3cdd32d33bbb24da3e512dca1fbf2689cf29eafe9f21a74d5c88572bf9df9
  • SSDEEP 768:cu6RaepTPYzbs8WU+Xaamo2q1HmaPcl83APITpzjb3gX3iGna6AmeBDZUx:cu6YepTPso2WfcS3lTp3bQXSQpRwdUx
  • TLSH
    T1832319003BE9813BF2BE4F7899F26145867AF5636603D65E1CC441DB4723FC29A42AF9
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2