Extracted

• • Target
    74f772c5d6841e5b6bdb0b01df919eadfd360297291fd65cccbe0eaf67a77c68
  • Size 45KB
  • SHA256 74f772c5d6841e5b6bdb0b01df919eadfd360297291fd65cccbe0eaf67a77c68
  • MD5 dea29986dd064dda62b1227252ece1b2
  • SHA1 9f67414eec692296da6af4a6ae70471175db559e
  • SHA512 f2e885740bd156df6f76260fa008f4b21617a6f0b06b38bfb9906aa9c2b79bfa8f285e56c8b94a11abd3776ada04bdbdfeca7e31eb100062a71e8f151687bfa8
  • SSDEEP 768:8uUIpT4vvofWWUEXb+Imo2q44O54qCBrHqNjPICzjb9gX3i8SB5u2PxyeUeBDZ0x:8uUIpT4vAj28O5d8qKC3bqXS8S5Zy6d2
  • TLSH
    T119231A0037E8812BF2BE5F74A8F26145867AF6633603D94A2CC452DB5713FC69A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2