Extracted

• • Target
    69e46d1abf1dbb094fc1f08e5040fe72c21fc8444e09f12c64149975b5f8dbe5
  • Size 45KB
  • SHA256 69e46d1abf1dbb094fc1f08e5040fe72c21fc8444e09f12c64149975b5f8dbe5
  • MD5 64af451db38816ebf232a4876fd1b370
  • SHA1 beaa93d2463a23da5875867f3ba065fe226a4f43
  • SHA512 62d02bc5b22495ca28022441079c1d365352b8e44ad32cd7723a1db4ec5544997f9468a4c829d800d3b3b4cda369a79e7216b4448113054ba2ccac77d20a334e
  • SSDEEP 768:cuR0JTPUYkEWUmjWymo2q1nfPLzizpvtLjZPI9zjbugXZivmbfQcSBDZUx:cuR0JTPjY2OfHi1VjW93bRXovmQcsdUx
  • TLSH
    T1CE232A0037E9812BF2BF4FB898F26145867AF6736503D94A1CC441DB5613FC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2