Extracted

• • Target
    076aebf8bd81c8a0cb4fe48b3efe54a943f46d433508e014e560047386486094
  • Size 45KB
  • SHA256 076aebf8bd81c8a0cb4fe48b3efe54a943f46d433508e014e560047386486094
  • MD5 4830a1ab50a2fbe061cf117d605d93f9
  • SHA1 d5ac71dbf5a9bb1be9c22ff21ea9ed22fb901f83
  • SHA512 28f6652f6e0f3c5b55319f09c44e8af287171e1d39b29a619856a07158bbf627b84537f814d27b9f34390110d35e1ee63dc5a71033993f9d98944ca313e2a11f
  • SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFYeeXKNoRRr8/nPI6lzjbkgX3ihNPbaSvShv/eBDZEx:MuLAZTnbg2oeQIRrKA6l3brXS/eSvShb
  • TLSH
    T171232A0037D8812BF2BE4F7899F26145867EF1633603DA5A2CC4529B5723FC6C6526ED
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2