Extracted

• • Target
    00968bd3d323eecbc373a5db2773b1d604fa382bead2d240933cbac5b4b5bb8a
  • Size 45KB
  • SHA256 00968bd3d323eecbc373a5db2773b1d604fa382bead2d240933cbac5b4b5bb8a
  • MD5 f89ffdd1d1906d5eb6cd72eb8825c5c6
  • SHA1 a4d69860c8e7d7d5c30a1cad9ec9570d45810eda
  • SHA512 89cb829a193680bf48764e48c51d77e602f51f5d505f1d7950c23aec4f0ae32d19c9eb89c057abe6cd364371bbc82b99c9dd816e19f8ce4efa16e6bb9e10e9bc
  • SSDEEP 768:cuR0JTPUYkEWUmjWymo2q1fLiE0yFjrdjYkk8PIujjb6gX3iFz8HPEBDZUx:cuR0JTPjY2SLBXQBuHbtXSFUqdUx
  • TLSH
    T115232B0037E9812BF2BE4B7869F26145867BF6732603D54E1CC451DB5A13BC68A43AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2