Extracted

• • Target
    66c7007d67a87035fe1d4da14d2455caeda3686be44297fefc330aff7f59ad2f
  • Size 45KB
  • SHA256 66c7007d67a87035fe1d4da14d2455caeda3686be44297fefc330aff7f59ad2f
  • MD5 7495f5a8b348b454f1670a1e5e37facd
  • SHA1 4a79a1a3493fb5c160c1502ceaf3a727bc6fc7a4
  • SHA512 b071c651eb8fd4f47017d518acc66ab3b91b341563eb90d4dba49a85e796cf776fba35aae0974317e1e9fb3ac1cb7c620c6a4217d329a4c70400913e00d9ae2c
  • SSDEEP 768:MuBGJTP0BQ0UWUWHaimo2qVJpt0CCM+d4CvS8PIkXjbagX3iIbyOVmEcYBDZEx:MuBGJTPho2Q/CFWBkzbNXSHi3dEx
  • TLSH
    T15F232B003BE9812BF5BE4B78A9F26145867AF6633603D6491CC451DB4723FC68A43AFD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2