Extracted

• • Target
    673132629f9c894b63c072cb7f7616c9082480a71f2fe275ebb6abebc99fe267
  • Size 45KB
  • SHA256 673132629f9c894b63c072cb7f7616c9082480a71f2fe275ebb6abebc99fe267
  • MD5 1d197621c7e764a97123deb75997abf4
  • SHA1 c8acd193a444508e9715111163e001cca2222f38
  • SHA512 b9c7dba8e33173eccaacdbbb7c9dca4b58d38cd08057726fb9098b210b8e8233c5c1e0c9783c41f23b6aaaf5efd949472a22ac757240d604ae90df9d7a16e8b6
  • SSDEEP 768:MuBGJTP0BQ0UWUWHaimo2qVE/q0CCMOd4Cpb8PID7jb4gX3i8VRAJvQlcB9z7gwX:MuBGJTPho2d4CtVBDvbvXS8VRyvScLz7
  • TLSH
    T187231A0037E9C22BF2BE4F7458F26145867AF6732603D5491C8451DB5B23BC68A43AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2