Extracted

• • Target
    c664ecabd90209f75dcad8e83f3bd2574e6ca8b13f63eecfb0f97cf54738894a
  • Size 45KB
  • SHA256 c664ecabd90209f75dcad8e83f3bd2574e6ca8b13f63eecfb0f97cf54738894a
  • MD5 fa53560581bb089e5ac8c1da76223b86
  • SHA1 96c1fbfb62559460110409883b6572c84386fd92
  • SHA512 b6cc2c3e440349a23b1e7650013fa65ff03cd1b7e5a43bffd8a4a00752017baff1f8a4f349fdc9c656e63b3ecc31671a4d84296d77c0935f92da1c382ea85e44
  • SSDEEP 768:cu6RaepTPYzbs8WU+Xaamo2q1lxGQG9PHuPIFzjbggn3idvcoVBstiq/+BBDZUx:cu6YepTPso2sHC3F3bHnSd0iqydUx
  • TLSH
    T1AE232B003BE8822BF2BE5F7899F26145867AF2633603D54D2CC451DB5613FC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2