Extracted

• • Target
    63d66dfa7523948586814af20e0d0d51738a09215d0d7e06de5cd05b95dc1c58
  • Size 45KB
  • SHA256 63d66dfa7523948586814af20e0d0d51738a09215d0d7e06de5cd05b95dc1c58
  • MD5 581535de262fee26c440c1d41ff24d2a
  • SHA1 525f5076961a67f64f5c1450789f76fd6fe25e30
  • SHA512 896c480a29161ab300438c32181c5d24d1ec4f17b4a8a93028eb1e3fc6816974b32146d01b6cbf5d16ffffd5ba2a58c59074bc2233c0f7541c3723de245d2cd7
  • SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFB3XoPEayPIWzjbUgX3irB0zv40T7+5rYOQdBDZEx:MuLAZTnbg2umEabW3b7XSrB0zvDTi5rT
  • TLSH
    T118231B003BD8822BF2BE4F78ADF26145867EF5636603D5492CC412D75713FC69A42AF9
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2