Extracted

• • Target
    473a73a294ff7eb7466641fa87a3e20c6ac7891ee2760b717819ef50a1d88d2f
  • Size 45KB
  • SHA256 473a73a294ff7eb7466641fa87a3e20c6ac7891ee2760b717819ef50a1d88d2f
  • MD5 67bd91cc600376bbc59038b3fda08d4d
  • SHA1 a7618c4f518b4689c102abfb3eb370e9a3ab3e94
  • SHA512 d591be84d35bfd36dfaf6c0ebe707ddfe772d96083f9aca6e9985e266387afe5930380e00b64c8d7d5a1e2c2497254d8d4896cfb3b36d17a49aa450508130468
  • SSDEEP 768:5udApTNctooWUS7C+mo2qtkZo3TMtPImVjbAgX3iOj+jfEE4+Y2BDZ0x:5udApTNmU2lU3m9bnXSOmCYd0x
  • TLSH
    T1A8233C0037E9812BF2BE4F7899F26145867AF1673603D58E2CC4419B5723FC69A42AED
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2