Extracted

• • Target
    7380533307a59a1cad152b4b54e4998261eb755d6f10666d73946deb06ceb66c
  • Size 45KB
  • SHA256 7380533307a59a1cad152b4b54e4998261eb755d6f10666d73946deb06ceb66c
  • MD5 610f4098278416df676bb2bbf53f0379
  • SHA1 fa234475a489a2dba275123ac75e2138b3129644
  • SHA512 20e3388a09e27991ceeccb9afaf067c0448e0f6e67924ce4c065a5f5658f039171e7d1d6db158064afaeadbb61b8f2d2a45c14460d61a6c6a0a3c1d1868f7657
  • SSDEEP 768:EufspTfzcR6uWUcb+wmo2q9LqTkafz+OPIEzjb0gXziy/GJzwPDjyXgAhABDZsx:EufspTf2g22qoR3E3bbXuyGJzASbWdsx
  • TLSH
    T173232A0037E9C12BF2BE4F78A9F26145467AF2673603E6492CC4119B5613FC68A42AFD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2