Extracted

• • Target
    7698ee60bd31fcc86bf4c4120fb64ad28ec4cc474429b54c745e5b4e9105b651
  • Size 45KB
  • SHA256 7698ee60bd31fcc86bf4c4120fb64ad28ec4cc474429b54c745e5b4e9105b651
  • MD5 f563043ef6aaf64b202d8c38512a80cf
  • SHA1 4fe3117da0daa582c3b5e6bdd5983532fac49451
  • SHA512 b7421897b5e8d7cda0c1b9bc8d27ba55574e6d9b850680f22dcdb93ac2da379fc41b701d8f1bd9e24902e60801710248b484951d303826e1de06574876760ba9
  • SSDEEP 768:UuKWgSJTwU6NkWUGnaSmo2qA5Bz5U4x7PIgkjblgX3i+x1dXBDZcx:UuKWgSJTwRf2pj6gkbiXS+zvdcx
  • TLSH
    T183231B003BE9C137F2BE4BB89CF26145857AF6632603D6495CC412DB5623FC68A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2