Extracted

• • Target
    66b0ff7308cba22c70d600bfe9286ff02915a018646e795cf00404492c6585f9
  • Size 45KB
  • SHA256 66b0ff7308cba22c70d600bfe9286ff02915a018646e795cf00404492c6585f9
  • MD5 848333ec5dc3afd15ff2f43e47fd8699
  • SHA1 4a3098e1de8aa008b6b77f626620586718df91a9
  • SHA512 b7303ae7c25966d42a9b17029b09eb248f0e2157597b9ac94245352e6fe9111375deaf3f56ba69116e1675c5c5fd5c1e6b89687af4c7d2d9cfbb07516c1e5a49
  • SSDEEP 768:DuAqJT84XVvWUXR1Zmo2qjL9Yq3q3hOPI2zjbygX3iPg1l05gGkX+actb67BDZcx:DuAqJT84v2AaCq323b1XS41l01kX+acb
  • TLSH
    T13F233B003BE9C12BF2BE4F7899F26145867AF2632603D6891CC452D75713FC68A526FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2