Extracted

• • Target
    68d99fb9bfb3515c156401b1dcb7fcd9fc6c2ec2f58f2eb060a7dd3164548c11
  • Size 45KB
  • SHA256 68d99fb9bfb3515c156401b1dcb7fcd9fc6c2ec2f58f2eb060a7dd3164548c11
  • MD5 a69ba74b30a7ecb897e7de0969c527bb
  • SHA1 ee7df5fd67f9cbe1ad0352aa2b4f8d08c7fa2f5e
  • SHA512 255fea69f14bddadf679d4dd4a96887a56a778a3066fb48e504904a87735a6313e54ee683f1987bf66c9c47c9a36f4bf41f21ee4719df8876ecefa0e09705a17
  • SSDEEP 768:EufspTfzcR6uWUcb+wmo2q9L9Yq3qvhOPIOzjbIgX3i/CGCht4qxVy7kSrlhdBBc:EufspTf2g2GaCC3O3bfXS/GK6Sr3xdsx
  • TLSH
    T111232B003BE8C12BF2BE4F7899F26145867AF2633603D5491CC452DB5623FC69A52AFD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2