Extracted

• • Target
    44f97881747d5491be6e96a4a758b68dcb17819498a18774497efa436af87628
  • Size 45KB
  • SHA256 44f97881747d5491be6e96a4a758b68dcb17819498a18774497efa436af87628
  • MD5 b90add4c8da5ee8264fade6066204e5b
  • SHA1 6cff64f27c13fe0e7c37d13ab2b413b42e696e7b
  • SHA512 60a2c0a549bb6de6bf5fb2a5d5ec1b0a7c7601144bd5dda3eadb10b886d4e2c2a6ba4f453a41c10c9696f3c7166cae91e660c66c616a7b07559d6b4a12fd1118
  • SSDEEP 768:EufspTfzcR6uWUcb+wmo2q9TiacyPzlOPIlzjbCgJ3iJPGQO6qT89dBDZsx:EufspTf2g2OiVC3l3blJSwQOzIzdsx
  • TLSH
    T17B233A003BE9812BF2BE4F78ADF26145867AF6637603D64A1CC4519B1713FC68A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2