Extracted

• • Target
    63f216997ef3e873c009f3861b9c942302dd8c8c4040a6e2c9241191c6c5f765
  • Size 45KB
  • SHA256 63f216997ef3e873c009f3861b9c942302dd8c8c4040a6e2c9241191c6c5f765
  • MD5 7fed8a4b19cf2e0e90e62fbef03c0739
  • SHA1 60b4c2a9f3d09fd83bbc1f43e0d5415f72b3ce39
  • SHA512 b41a38c440783fb64a67d64705851cbbef2fda15dbeb64e1c8ebdd5763adfaa1ebe34021d5e5e0556abd956b8aadca0cf3977292637f19d053678fe0dd161f81
  • SSDEEP 768:cu7m/5THrq+CWUoDuMmo2qFb3xq6YFoOPIUzjb/ga3i7JgXdo+smSWBDZUx:cu7e5TH2A2ukxo3U3bIaS7yo+smBdUx
  • TLSH
    T14F231A003BE8812BF2BE4FB899F26145467AF6B37603D64A1CC451DB4713FC696426EE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2