Extracted

• • Target
    00f69ff0b9944a94c7d0a39fa953e2d4f1a2d1dcb9d2f76a55ba682a365703e4
  • Size 45KB
  • SHA256 00f69ff0b9944a94c7d0a39fa953e2d4f1a2d1dcb9d2f76a55ba682a365703e4
  • MD5 a56095c2b284d26a70eee6aa5437ab97
  • SHA1 23ca5b46df095c4055c77c28a6b0874300059627
  • SHA512 23b713ff54ca2a0c2fa91504c29a370f0ec127a356f18aed15f4dbf2b72566efdad3edd511bd8e6d1c49fee2366ccc47238d712ca60087be16b240204e0feb9e
  • SSDEEP 768:0u1YJTHwAUgQWUaT2Wmo2q9yhkQHJcOPIcMzjbngi3idSs0pIXsuD7V6/aBDZ8x:0u1YJTHcw2EsW3cM3bgiS70ysuDo/Ed+
  • TLSH
    T135232B003BE8822BF2BE4F749CF26145867AF6633602D58E1CC451DB5613FC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2