Extracted

• • Target
    acb6696f3911303ed13fc4203003fd7f8f2e5e61786f1beb7a36076e7fcb8eb4
  • Size 45KB
  • SHA256 acb6696f3911303ed13fc4203003fd7f8f2e5e61786f1beb7a36076e7fcb8eb4
  • MD5 df85e3468354f9ccaad3ddcb53e45c85
  • SHA1 b705636ed8283a66c71b474dd7cb24b989a0745d
  • SHA512 5b75e50e30a45775cb5a29cc97efe19be9432c21ea280c6ac6e0f37a747adf063979c17300b791e0f3ef77498ca103c50bc540b4e7f337e4890ac556525942ec
  • SSDEEP 768:0u1YJTHwAUgQWUaT2Wmo2q9ZRzMwnOPIZzjb4gX3iV983DdRG8m2PsdJfpBDZ8x:0u1YJTHcw2SA+3Z3bvXSP83+ePsdJPd+
  • TLSH
    T1F6232A0037E8823BF1BE4F78A9F26145867AF6673603D58E1CC4519B5613FC68A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2