Extracted

• • Target
    263bed1dd8e7272b175aef5a65fb1bcb5cdf5ff2436daf165c1fbfd8bd793812
  • Size 45KB
  • SHA256 263bed1dd8e7272b175aef5a65fb1bcb5cdf5ff2436daf165c1fbfd8bd793812
  • MD5 16400ab5e8be2f902d07d96a297e3a2f
  • SHA1 fb86defe3ae54b5e4f89101c91328596847e044e
  • SHA512 9cacd8a74e90effed3c2a0c2188e4751bd436fedba9bea1288610ea4ba97b423007920f3bd47d5573eebaafbe799b95e6aec02c4339bb36ed1f2cf86bb241824
  • SSDEEP 768:cuq04JTLcsP8EWUmOTymo2qAu0ewtSc30oiZPI3zjbugX3iaPeRJIBDZUx:cuqNJTLr62gww2iW33bRXSbGdUx
  • TLSH
    T1A3231A003BE8812BF2BE4FB4A8F26245867AF6636603D5491CC451DB5713BC69A43AFD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2