Extracted

• • Target
    e65d605266c898b3efb47d34f4caadf60daa58bd3bbcc67702a70c055cdda3fb
  • Size 45KB
  • SHA256 e65d605266c898b3efb47d34f4caadf60daa58bd3bbcc67702a70c055cdda3fb
  • MD5 a0ab5c3ede4ca0ff77e79007ffebee69
  • SHA1 fb5afd5f1c1cc8d91ee4a1cee0602f1f8ae4ac4c
  • SHA512 c67676134cc7742dd5ebd4b806840344e284ca457df33ceb7f34e7f102833077729341d1dc85146b923a987c5e08a7577ad7e99fff62e6ec94917ef2c18007a8
  • SSDEEP 768:kuSOpTPTCFcWUeXa6mo2qAh8V1QpfEcPIYzjbugX3iQvFd/1ozRsIKdOisBDZMx:kuSOpTPOP2x8ViBEhY3bRXSWd/1ozAd1
  • TLSH
    T1C1232A0037E9822BF2BE5F78A9F26145867AF2736603D64A1CC451DB1713FC68A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2