Extracted

• • Target
    65751986b04a683488e21fa7ee65d0e3101207c5297a2a94e3c915cba0e1454b
  • Size 45KB
  • SHA256 65751986b04a683488e21fa7ee65d0e3101207c5297a2a94e3c915cba0e1454b
  • MD5 0c98e8fd860d473d3a360ce034c56045
  • SHA1 366a96579d798e86aeb6b76b4a77a45b613573af
  • SHA512 cec650827b2f0caafc7dcb0043789d9c802c078165c428b39a8f82d2f979bd5c872826dab7623e5503d9e7f85f75ba37536d41084d2ff9b5318f906341087ae1
  • SSDEEP 768:8uUIpT4vvofWWUEXb+Imo2q4Mwz/y3qiPIzzjbSgX3iwgGtM/5Wi5BDZ0x:8uUIpT4vAj240hz3bVXSMaYad0x
  • TLSH
    T1A823190037E8C12BF2BE4F7899F26145867AB6633603D58D1CC412DA5B13FC69A526FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2