Extracted

• • Target
    a61c84cbc0c34cf12f840312cfb8b202aaabfe6c4ef298fb5b1e66ec4ac729da
  • Size 45KB
  • SHA256 a61c84cbc0c34cf12f840312cfb8b202aaabfe6c4ef298fb5b1e66ec4ac729da
  • MD5 0fdda650a8612f1d1c5bbe42abcaf22b
  • SHA1 64b84b845d63b5e564af1a5b50a6e28e68990d0b
  • SHA512 2471790606dcea38bb14b18657bbaee75f197b1ef368e91129a5599c3096be1d1d4d56ab0c8c45c1b7528f41e8852485c82ea20044014fafdbe156e537997b29
  • SSDEEP 768:5uSy6pTpwrSWWUE3/WImo2qN9EYSCBTPKNjPIZzjbbgX3idvoM4u8xbnEiIFJBD:5uSy6pTpoo2sEl8KKZ3bkXSlovnwXd0x
  • TLSH
    T1E8232B003BE9812BF2BE4F7858F25145867AF6637603E54A2CC451DB5713FC69A02AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2