Extracted

• • Target
    d7bec97d927d089056adfb4cd1eb39b44508a639b63e04f4a8a6c41d375ce9b0
  • Size 45KB
  • SHA256 d7bec97d927d089056adfb4cd1eb39b44508a639b63e04f4a8a6c41d375ce9b0
  • MD5 d3b1a4855f41073cca7e8c767b2fb4d3
  • SHA1 71c9e5382a7dd9f190a13dc0f267eb8dbc43a3f7
  • SHA512 c0739e1786c95c93f69a8f8e3bdba40f33346865df2018bc51e6e817bae90c81764df9019ec75da8e7a1c934dde498b47224b07fb4b5770ffe29568b26b55672
  • SSDEEP 768:MuBGJTP0BQ0UWUWHaimo2qVJpt0CCM+d4CvS8PIMhjb6gX3i3KbHsr/sBDZEx:MuBGJTPho2Q/CFWBMxbtXS3KbKidEx
  • TLSH
    T136231A0037E8812BF2BE4F74ADF26145867AF6636603D54E1C8451DB1A13FC68A43AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2