Extracted

• • Target
    63052f8e9abb250835cdd417eae3f923ad0144d030cece761e3adc9a38cb9ae6
  • Size 45KB
  • SHA256 63052f8e9abb250835cdd417eae3f923ad0144d030cece761e3adc9a38cb9ae6
  • MD5 22816b761d27969184cc6b9270a76bea
  • SHA1 87b437febcec2e4f8d38957ad89db425e4721b5f
  • SHA512 a79eefc4267f19c3e2abfc31cc3ee13e02ee0c56644246866ade193d797c4b7131ea5f1cd79b33dd50402246577aa4c8746b8a3bc1824ba0079b2695364f574d
  • SSDEEP 768:cuR0JTPUYkEWUmjWymo2q1r9PLziqyvtLjZPIvzjbagX5ijv42Z02+KvuX8tgIB0:cuR0JTPjY229HivVjWv3bNXIjX0BKmMg
  • TLSH
    T10E233B0037E9812BF2BE4F78A8F26145867AF6632603E54A1CC452DB5613FC6DA426ED
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2