Extracted

• • Target
    dae8d07e64ecb947ff339e49dc8d76a7504a16be63275a73c490d83a62c6b6f8
  • Size 45KB
  • SHA256 dae8d07e64ecb947ff339e49dc8d76a7504a16be63275a73c490d83a62c6b6f8
  • MD5 7f2deafc713cc79d57f0ad7dbe77707f
  • SHA1 77391305ee7f79095e81fbfcacd75955e1685c90
  • SHA512 9c1a27dea9e851c52a3413f4ba7b4b1c9c7356666401f4bd24db3020d8b47d0177882e421c48de7db1fc28befe2b099b49d2df5633ac89c656050c8c688b4093
  • SSDEEP 768:RuxkJTVmU5EkWUGMKSmo2q1bI0tnxHuPInzjbHgXSiqB46VkcEVuBDZcx:RuxkJTgip2m3r3n3bAXbysgdcx
  • TLSH
    T12B232B0037E8822BF2BE5FB498F26105467AF6677603D64D1CC442DB5623FC69A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2