Extracted

• • Target
    67926f403c35ea3b36168314a912b341618a253d10595251002b7e5fe271f8e1
  • Size 45KB
  • SHA256 67926f403c35ea3b36168314a912b341618a253d10595251002b7e5fe271f8e1
  • MD5 0cccff1359bc4b33b88fc7392fc8b341
  • SHA1 b43375aeebfcf2c9f9155b1649992c02a9773c07
  • SHA512 98e9afb28a4181b2e7b4e18a02ec240e94addd9518349fe849ecce6dd7b86a44389054742462f25c47ff82bad29716c922f87029749450b44e74604523dcb5f8
  • SSDEEP 768:8uuSpTg7GBoWUSH6+mo2qYlCSwTMSPI5PjbugX3iOdk1uXup16Pp5BDZ0x:8uuSpTgyf2dgG57bRXSOdkIXupipnd0x
  • TLSH
    T132230B0037D8C12BF2BE4F78A8F26245867AF6673A03D58D1CC451DB5613BC696426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2