Extracted

• • Target
    65ba8c4b1ce50963435ac6bffc8157318684270e91647a17799a490237fd2809
  • Size 45KB
  • SHA256 65ba8c4b1ce50963435ac6bffc8157318684270e91647a17799a490237fd2809
  • MD5 5ba20216a15114d2bf20a004c5bb9de0
  • SHA1 0249f6d2916e2add387916d949243dc04fc30d1a
  • SHA512 65a3277f28951df6d8054aa333e91f0b91232e552014338e1d8eeae3f1ffb78e5c6239cfad0ae85f5be2504f5842660e79b3e4178ff4aef7a63fa8f59a8020ee
  • SSDEEP 768:0uPrpT/LGKeWUszuAmo2q9i9wa0y/zFOPIuzjbzgO3isNWYAvapvcVDv3XBDZ8x:0uPrpT/qY2/Cdi3u3bsOSxFvivcVDBd+
  • TLSH
    T1AE232A103BE9C12BF2BE4F7899F26145467AF1633603D64A1CC451DB5B23FC68A426EE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2