Extracted

• • Target
    67efc1e4d40f7533db0c4385c55cd26e893fe3b606db28e82adc4380ea8fddf9
  • Size 45KB
  • SHA256 67efc1e4d40f7533db0c4385c55cd26e893fe3b606db28e82adc4380ea8fddf9
  • MD5 8fc44b9d281efe3e335df46912365e55
  • SHA1 e0e7884b8eab24cf8fff5bc0cb6ffe83746d79f5
  • SHA512 379d2553a5cc5b20a5066dfeac7bf0c780232277a085a8182ba0971a080d896e7376f9e26f9842ea97dffd935190bf159ecf7e12e4373c869f29e67539fb6a14
  • SSDEEP 768:5uSy6pTpwrSWWUE3/WImo2qNDIrnyfaaPIhzjbqgX3ildhjnZjpCCPgnjWBDZ0x:5uSy6pTpoo2g8xh3b9XSvhvCLj4d0x
  • TLSH
    T162232A003BE9C12BF2BE4F789DF26145467AB6633A03D58D1CC451DB1613FC68A52AFA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2