Extracted

• • Target
    685553390676911f83f65300c708dfe67e96e0d1df619a3a4bce30b8472b7b38
  • Size 45KB
  • SHA256 685553390676911f83f65300c708dfe67e96e0d1df619a3a4bce30b8472b7b38
  • MD5 65549c8201937e935e1f47103c00c033
  • SHA1 19a32e24b08a76b8887476d5d711b0b068e4683c
  • SHA512 dd6c51c250cde46cc678e708ba1c700ab8903b67ea10282205377435a5b437ae6835e635e8ac769a2a20f83e5912479f72c5e5f0692c7fcafbe6f07c64d25f59
  • SSDEEP 768:suJdpTP3tcsWUODmqmo2qV5pzbU38aPIQzgbbgX3isfEPTBgx93vnbwBDZkx:suJdpTPdI2kZxQ8bkXSsuBqlvCdkx
  • TLSH
    T10F232A003BE8823BF2BE4F78ACF26145467AF6637603D6492CC4519B5623BC6D6426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2