Extracted

• • Target
    66a24a42866279d6f75eece680fae7643770f4aad1b3e98f6603cc044fc8a030
  • Size 45KB
  • SHA256 66a24a42866279d6f75eece680fae7643770f4aad1b3e98f6603cc044fc8a030
  • MD5 d947d27292ee49e7c1decb19b3de3421
  • SHA1 7d92d3c86e1f77751daa3aaa7eaff62021c16ec0
  • SHA512 5c4cf4231fea8e4b173bf04e538da397f3d873763637b031768fdbece98de32c1d90a4f4208d97070cea86e91f687d292fa9fefd9fe1d595620543bb4e13ffa5
  • SSDEEP 768:kuSOpTPTCFcWUeXa6mo2qAhpt0CCM+d4CvS8PIMJjbygX3iufYS8BDZMx:kuSOpTPOP2x/CFWBMpb1XSuYrdMx
  • TLSH
    T18B23190037E8812BF2BE4F7868F26145867AF5736A03D54E1CC451DB5A23BC69A436FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2