Extracted

• • Target
    865b624d64f9a395f9eeae424afba53d5646c29c7438a807058f9fba0e172258
  • Size 45KB
  • SHA256 865b624d64f9a395f9eeae424afba53d5646c29c7438a807058f9fba0e172258
  • MD5 d1e17d19f96ee641f9360cc06421a679
  • SHA1 0b46e7749fc50f24fb88ae487576d7294a558740
  • SHA512 2c111d8b8a59e5e8c8e2648b6e7cd93832d71dbd670da287f9bf4d88c8b4d1157e5f49ee8c602a170c2275985f8fe9decf18e0759b62f5252c4862c236792249
  • SSDEEP 768:cuq04JTLcsP8EWUmOTymo2qAzQ0D3+/vPPjZPI7zjbWgl3i8fs2TQ3foRbiEBDZW:cuqNJTLr62jP32/jW73bJlSH2TQ3foRG
  • TLSH
    T120232B0037E9812BF2BE5F7898F26245867BF6632A03D5491CC451DB5713FC68A42AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2