Extracted

• • Target
    66c8c5afc97c7a15815b9b977b56c2ab665d4f97196bd82ceb567a3205e9677d
  • Size 45KB
  • SHA256 66c8c5afc97c7a15815b9b977b56c2ab665d4f97196bd82ceb567a3205e9677d
  • MD5 74ef4b989d4d34f3355410f86e3f6c47
  • SHA1 7d571bf1296c1dee1a4513d3ebdcd0d02d26a76c
  • SHA512 6689cf812bf2f035eab47f26bf23455bdd6737c8237e74aab9173bda32dc4de52c33d1ecc1ee83da15b8c3a1f5d530f997435fc253fddaa764e2ae1c50d019d8
  • SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qF1Nd3u40cMOPI04zjb8gXzijzkSyBfVM6nkJ+HDBDZG:MuLAZTnbg2m8+M3043bTXujwR9M1+HFE
  • TLSH
    T1AA231A003BE8812BF2BE4F78ADF26145467AF6732603D64E1C84529B5B13FC686426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2