Extracted

• • Target
    f658f1bf94b88da3f53db62cc237bfff33c019f036cfba987650ac98a9d0477d
  • Size 45KB
  • SHA256 f658f1bf94b88da3f53db62cc237bfff33c019f036cfba987650ac98a9d0477d
  • MD5 1bfe09f4f5536b90710165bbb4ba3212
  • SHA1 c8df622e37d1c7b0812537a6fd50e4e5ba83d562
  • SHA512 c1718b17702bd4728369f6f044e4418f7a84fe222c044170d06f7ae4ee4364eb04369044e88a8d13b54f438916521a81004973a220b24915b04a61d0c337c1c7
  • SSDEEP 768:cuq04JTLcsP8EWUmOTymo2qA02q0CCMPd4CvS8PImgjbNgX3iTFpsh7c/AeVDBDg:cuqNJTLr62ERCEWBmIbaXSr+7+HVFdUx
  • TLSH
    T13523190037E8812BF2BE4F7459F26245867AF6732603D64A1C8451DB5723FC68A53AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2