Extracted

• • Target
    07324c7def55f852b68cd76ee734933494cb17008ef6dfd153165e8845587305
  • Size 45KB
  • SHA256 07324c7def55f852b68cd76ee734933494cb17008ef6dfd153165e8845587305
  • MD5 66290ef41e08123ef98c17e0929d48cd
  • SHA1 49d30e25b61d5a652c11bd6bb1431292456c0ca5
  • SHA512 e80b64ed69f38c374682c546ce6a8f4236609543e820f6ee680132c85bac6091b1358c785ab9afce6686a7052c2901b089eed714c85f269147401c9ebddedbe3
  • SSDEEP 768:ku40ZTX3uXTaWUgzW0mo2qwY7lt440WMOPI0szjbWgX5i9o9jYseDSafd1R+BDZO:ku40ZTXEb24gUM30s3bJXIuEgafd1WdO
  • TLSH
    T1DB231A0037E8812BF2BF8F7898F26145867AF2637A03D64A1CC451D75613FC6DA526EE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2