Extracted

• • Target
    64f93754acb4701b00a3fe9d46e3d0feef776f6110efd49cbf3218859a5950aa
  • Size 45KB
  • SHA256 64f93754acb4701b00a3fe9d46e3d0feef776f6110efd49cbf3218859a5950aa
  • MD5 6f3cb034b1a97aed2015eae7c67ec006
  • SHA1 deb0ffdcd7448d2029b8709a6d343934e87987b0
  • SHA512 6e31944a4a048e5b5648eaaa5cb480619e11720bd46bc7df02f0ef02b51c083029771c63e336f4910e2abb2028b0830bc924fec2d3d812e401cbfa7443969149
  • SSDEEP 768:EulCJTHESwgWUK3aGmo2q956R8aI3OPIOzjbggB3iNXHEUr+Fhss9BDZsx:EulCJTHl42m+FO3O3bHBS9/EhsSdsx
  • TLSH
    T1FC232B0037E8812BF2BE4F78A9F26145867AF6673602D58E1CC451D74713FC69A42AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2