Extracted

• • Target
    d76e9c4e216ca59275554361cd8a98e77cf4ee72518ca1831dc4f16c2f4f3983
  • Size 45KB
  • SHA256 d76e9c4e216ca59275554361cd8a98e77cf4ee72518ca1831dc4f16c2f4f3983
  • MD5 368316a130d4c2849d062658f7c4735c
  • SHA1 8c4219750936f3c3fb939462f52124620b47d8e7
  • SHA512 16aa0df624ee09d6b8016b5d6ed956a36c22c6e9c947342f2beb92d99a4609ccad8b5215ef07f5b103b69067564f2a2be9692d7d85a753ab76cc48861680fd46
  • SSDEEP 768:kuSOpTPTCFcWUeXa6mo2qAhpt0CCM+d4CvS8PIkgjbvgX3iYLCDEWoYlt90Lm7B8:kuSOpTPOP2x/CFWBkIbYXSYLCAWoYIm6
  • TLSH
    T194232B0037E9812BF2BE4B7898F26245867AF6733603D54E1C8451DB5723FC69A426EE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2