Extracted

• • Target
    775a31255570b0988c9e1038dd2af2a4a6b02fbfb334a92401e17b0206a1d9be
  • Size 45KB
  • SHA256 775a31255570b0988c9e1038dd2af2a4a6b02fbfb334a92401e17b0206a1d9be
  • MD5 d9b53093486214d873140954a9ffad4d
  • SHA1 6a080e1d2be2bb81ccd6e4e3f5424034251dabf5
  • SHA512 f203e001ab9b943984948ff5f1037da01714489b6759d9ed97240d4166c807d1d5cc97c4d064e03b37a332790cb8d9bd4fe7be1da5f21a591d0ef6b7411b8317
  • SSDEEP 768:wuZ8pT1Uu4/cWUeT66mo2q1V8V1yp7EcPIpzjbOgX3itv3+TQ8xBDZMx:wuZ8pT1tc2W8V41Ehp3bxXSt78PdMx
  • TLSH
    T183232B003BE9823BF2BE4F789CF26145867EF2672602D6891CC451DB5623FC696426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2