Extracted

• • Target
    dbcf664120893e133be18443bdd033d0582cb344daf62dc788fb92bc7e88b525
  • Size 45KB
  • SHA256 dbcf664120893e133be18443bdd033d0582cb344daf62dc788fb92bc7e88b525
  • MD5 260d4579164046b69355071a7830795f
  • SHA1 cb657ad3cd919be1bf0a150c74c23f2451b34901
  • SHA512 782e7b529c6aa3c18a1b27aab99a1356f2e93f08143b78156e3a56f43c9b05f42b3f5114a07ec86e76e8012da4559eeb44ebec958eea8d09b63f5abb0a51cfd9
  • SSDEEP 768:EufspTfzcR6uWUcb+wmo2q97yacyPz9OPIVzjbtgq3iFSyKpiX9D+BDZsx:EufspTf2g2WyVq3V3b6qSxKpiXydsx
  • TLSH
    T1E6231A003BE8812BF2BE5F789DF26145467AF2633603D64A1CC4519B5723BC68A526FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2