Extracted

• • Target
    75fdbfb8c3ca40a9fd397eb176a854ad1678f24d7b0bd8a54356152520901298
  • Size 45KB
  • SHA256 75fdbfb8c3ca40a9fd397eb176a854ad1678f24d7b0bd8a54356152520901298
  • MD5 283962ba64e2f18e8c15114b70861bc3
  • SHA1 f37490c05adac91b694a9e57222a1c165c457467
  • SHA512 b373c66234997360bb0d11e17397d8040436a39b47cb84546845a020bf1405edf961bcebc785b96b4f4fc28be53771c3f2468e4a8453dd66c5a9a8cb96c143fc
  • SSDEEP 768:cu7m/5THrq+CWUoDuMmo2qFu3XodEayPI/zjbAgX3i6SmVjYsqKl96PaHRmi8bX2:cu7e5TH2A2NUEab/3bnXSJiqhiHRv8bG
  • TLSH
    T1E52319003BE8822BF2BE4F7899F26145867AF6633603D54E1CC441975713FC6DA42AFA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2