Extracted

• • Target
    b898781706299a2b6676c33279986331af0939adda45ac34fde7be8d3dd5af64
  • Size 45KB
  • SHA256 b898781706299a2b6676c33279986331af0939adda45ac34fde7be8d3dd5af64
  • MD5 b63c178af65e164fd7f7e8c4b92ddcd9
  • SHA1 a92d066c7e5da26f4f5b0ba9c07d5c206e2233b8
  • SHA512 a540bbed32ac2fca195764dd052bf6a8e48182cf28dfa75aa6ebfb6a1647ca6ea349e60655ecaec96606c779485a9e050463567d44bdd60f52eb64040bce780a
  • SSDEEP 768:EufspTfzcR6uWUcb+wmo2q9LqAYaayNPIHzjbGgX3cUapvvg8KpEib4Ak1BDZsx:EufspTf2g2WqzqqH3bZXMUeKp/qbdsx
  • TLSH
    T195232A003BE8813BF2BE4F7899F26145867AF6633603D64A1CC451DB5623FC696426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2