Extracted

• • Target
    d81d32df76bb521a70dce00cf60429be42635ca2677905639ab69040b4a571e9
  • Size 45KB
  • SHA256 d81d32df76bb521a70dce00cf60429be42635ca2677905639ab69040b4a571e9
  • MD5 77c36c556b4569764552b9a187a9bcfd
  • SHA1 4f0a6779bbd987883974eeeef8da53704c7acc2e
  • SHA512 e79712439689e90d4dd26cac37189e5cf77019ce09c563e8c3afceabaf0fc883f6797896d73e5a098e6f3d6f67be326015af4f1b78998cacbe149fc9ad21e49e
  • SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFOeeXK5oibbb6TN8/nPI6WzjbugX3i5hlVTUBTNBDZG:MuLAZTnbg2aeEqTNKA6W3bRXSETDdEx
  • TLSH
    T115231B003BE8812BF27F4F789DF26145867AE6732503D68A1CC4519B5B13FC69A42AFD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2