Extracted

• • Target
    67b2ac44eeccd56d27cf01e57b148cfce101d8bbfad19fbcf4620ceb2a9d2087
  • Size 45KB
  • SHA256 67b2ac44eeccd56d27cf01e57b148cfce101d8bbfad19fbcf4620ceb2a9d2087
  • MD5 fa426cbe74b964b479850b64dca884e2
  • SHA1 aa0f44312afdbf699d9f298662a1939fc050f974
  • SHA512 0870b61b6a1698567710534c8ef06ebbdeffe06a247c70f3c10c81b7f0c47deaa7718fcbbe9dd12848c3626c59c8423bebe1b2dfe62520aa666532a6a11c803b
  • SSDEEP 768:EulCJTHESwgWUK3aGmo2q95dR3aI6OPIuzjbygt3iNmDdaBI7ls0ZyM3BDZsx:EulCJTHl42mjqb3u3b1tSrwlsbMxdsx
  • TLSH
    T1FC232A003BE8C22AF2BE4F78A9F26145467EF6672603D58E1CC451DB4613FC69A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2