Extracted

• • Target
    0641af9970361fa369aef22aa4da6bf50de8d4d5c2e81695724806b36f2c2ad2
  • Size 45KB
  • SHA256 0641af9970361fa369aef22aa4da6bf50de8d4d5c2e81695724806b36f2c2ad2
  • MD5 f3b5199bc387047feef9844f27268a7b
  • SHA1 a3d5399ffa033b9d438d0bc5b6a24610845b2a6b
  • SHA512 be6d464d97790f24f162ac7500e29ade35881c1b1c8a3a87eb5fb28abf8d8bb62b65b5fbefeb093528f1a0f2cf6201168603d231fdb80d30b21e031c0d182ada
  • SSDEEP 768:MuBGJTP0BQ0UWUWHaimo2qVdcP0pycvHPIjzjbXgX3iF/reQXtBDZEx:MuBGJTPho2OccMcvgj3bwXScWjdEx
  • TLSH
    T1A8233B0037E9863BF2BE4F74ACF26145867AF2633603D54A1CC4519B5623FC69A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2