Extracted

• • Target
    788c093806fdc925e0dee2721ccabac7cf9add29535c67f96717210559cc673f
  • Size 45KB
  • SHA256 788c093806fdc925e0dee2721ccabac7cf9add29535c67f96717210559cc673f
  • MD5 9b0471c8e221c9c45d56fa902bc3c12c
  • SHA1 731ad1eff0c77f1b58ef9384d9bf013317e088ba
  • SHA512 e8fb6d9e9ec55d43c33ff19506736d72e82f4ae89eab23e13f566f11f51f99680335a6d8815eebd374f41e78e88b6ff976ab67a145fa6c0903de545b89e21b69
  • SSDEEP 768:5udApTNctooWUS7C+mo2qt59+U6NbtOPIMbzjbrgX3FOeFTRX+4/oIkCABDZ0x:5udApTNmU2W9UZ3Mb3bUXVOMFu4/jWd2
  • TLSH
    T16E232B003BE8822BF2BE4F7898F26145867BF6673603D6491CC4519B5613FC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2