Extracted

• • Target
    746e2ead0065c022af530ae61ebf4e18b79c50fee87f06488db6b88250f07a73
  • Size 45KB
  • SHA256 746e2ead0065c022af530ae61ebf4e18b79c50fee87f06488db6b88250f07a73
  • MD5 9f380d6d32c260b594499c3670506ef2
  • SHA1 36759254d1ab5348c7b34cde93de7e69cf889c38
  • SHA512 e5b75eaa4611d1e40b55c3f32bb01cc8478f89827f96fe9ea05c4f37319fade298042f58cd92a0cb3dc2b76f3bcbdede1238935368cc033cf5ebea655acc39b8
  • SSDEEP 768:EufspTfzcR6uWUcb+wmo2q9wO5QSCBzHSNjPI7zjb4gX3i0wyAx46BDZsx:EufspTf2g25O59ESK73bvXS0wyAdsx
  • TLSH
    T17C232B0037E9C12BF2BE5F78A8F26145867AF2633603E54D1CC452DB5613FC69642AEE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2