Extracted

• • Target
    66fd692f8f325c15a17bac27ce7eadad1ba74fcef2589ca69c75285fcb687554
  • Size 45KB
  • SHA256 66fd692f8f325c15a17bac27ce7eadad1ba74fcef2589ca69c75285fcb687554
  • MD5 f3fb74391c95126c68e4c9f91d23188e
  • SHA1 342b0fe787553829fef058f583f6b843291c2005
  • SHA512 b784026647a922d42fc62cdb4f0511fde41986859df8ce0b9519c0fd97e203960297b60aa782938c50f3b6db8ab9211b92488b3d60ca801ca37425380cb690fa
  • SSDEEP 768:cuR0JTPUYkEWUmjWymo2q19/D0CCMAR4np78PIcNjbygX3iPqQB4qapeDIqBDZUx:cuR0JTPjY2kTCzwBcFb1XSPdOqapc7dW
  • TLSH
    T158231A003BE9812BF2BE4F7869F26145867AF6732603D64A1C8441DB5B13FC6DA436ED
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2