Extracted

• • Target
    0666246d8c86643f84eedde402e9040487cc5fb8ff77bc1b2b11e725385b1149
  • Size 45KB
  • SHA256 0666246d8c86643f84eedde402e9040487cc5fb8ff77bc1b2b11e725385b1149
  • MD5 ed9a5f2106bdd6ace8a67dd29fe5a489
  • SHA1 6bb821712ed49cd6fbc4f1609822afa41339b7d1
  • SHA512 a262f87e2b3e8edea8d783552f4c4e5116cf9b5ee2ddfcaeeeffb301316b3da51d6d57f2e82d2a56352c620c2abb7c117255fb8f60905d04580cfaba0690112e
  • SSDEEP 768:5udApTNctooWUS7C+mo2qtjZbtDMQPI8Pjb8gX3iPhoGG5YMGtBDZ0x:5udApTNmU2sJk87bTXSJ1jd0x
  • TLSH
    T1C9232B0037E9812BF2BE5B78A8F26145867AF2673603D54E2CC451DB5623FC686427FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2