Extracted

• • Target
    ab6600ad33f9191132efc48f35f42f41bfacbf607de72c94c603a91ab9985c11
  • Size 45KB
  • SHA256 ab6600ad33f9191132efc48f35f42f41bfacbf607de72c94c603a91ab9985c11
  • MD5 964057dad97c4250676d0766b4a36da7
  • SHA1 06365386102db36006a0ed61ffb9a41b9479fa9f
  • SHA512 e4ed774dc3829b6d7b864496730df77f8500a41cc6a55971d09a26314202cdcc894b85e618966387a8b1a37c4dc1dc50d4042a09dadc2cc6d38b1a52be9c89ee
  • SSDEEP 768:QulLJTEs+EgWUKJTGmo2q9qCSwTMjPIuOjb1gX3iOacc4SaljxPItuBDZTx:QulLJTE9X29g1uibSXSOncyJggdTx
  • TLSH
    T126232B003BE8812BF2BE4F78A9F251458A7AF5672603D55A1CC441DB5723FC68A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2