Extracted

• • Target
    75207ce6ac8742baf2e76b3c8ccb95537c23def64a328dd768f6e39e8a4518ed
  • Size 45KB
  • SHA256 75207ce6ac8742baf2e76b3c8ccb95537c23def64a328dd768f6e39e8a4518ed
  • MD5 74c01c4273025e0faf70c503d5902907
  • SHA1 63ada28338c9212faceaa299cc8d8f24174db119
  • SHA512 d3e7b557c1f54e889905a95bce98622cdb829e3d8136d700d077650158f8a7a21ceb892f8e5016747cc235e5f35a218d266b91db25877eaaf9c8e78328b62856
  • SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFo3HE4eVoOPIGjzjb4gf3i3Uob3w7ngAtBDZEx:MuLAZTnbg2BU1o3Gj3bvfS3a7ngAjdEx
  • TLSH
    T1E1231A003BE8812BF2BE4FB8A8F26145467EF6676603D64D1CC451DB4B13BC69A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2