Extracted

• • Target
    654eb42870b4d0fece1637d5dd8b8f6b4013d915066efd1d4e74ea0b1733477d
  • Size 45KB
  • SHA256 654eb42870b4d0fece1637d5dd8b8f6b4013d915066efd1d4e74ea0b1733477d
  • MD5 e7ed475af1e386b5844d426ee9ca738d
  • SHA1 9971be2943f63226d5dfb4294e02b53cc075813b
  • SHA512 3513bfc49979f415ba0b6d3a35396b5eb8040eacf6fcb005b51409b844a9446459ff9982791a046fb05ae3085fd5fccca37251864b196accfe36e3cafaf0ed7a
  • SSDEEP 768:RuxkJTVmU5EkWUGMKSmo2q1aqJaxjwHuPIPzjbvgs3ixTRHM2jYjnkmjuTGBDZcx:RuxkJTgip2f3+3P3bYsSpknkm6TIdcx
  • TLSH
    T11B232C003BE9822BF2BE4FB498F26145467EF2637603D5492CC452DB5723BC59A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2