Extracted

• • Target
    67aadbeee1b9f397f09459094b74ed34b55b1d299cb0d9b132a1cac7b80a25f7
  • Size 45KB
  • SHA256 67aadbeee1b9f397f09459094b74ed34b55b1d299cb0d9b132a1cac7b80a25f7
  • MD5 19a7255f708b3ceffab66b168ba11c9d
  • SHA1 2ded832e4332ca8a03b4dfb7a257794f92560567
  • SHA512 2be2336851c4aba47996eff0ba11ec4e1ecaa91b14256bb5f10983c6075c25bc1c3b9e6e49b350b2f823a0049cf004ffa2b483c19e705c70ec2338f50795dffa
  • SSDEEP 768:MuBGJTP0BQ0UWUWHaimo2qVW9PLzizyvtLjZPIXzjbsgXzi07D4hE6BDZEx:MuBGJTPho2L9HiGVjWX3bjXuoSEkdEx
  • TLSH
    T1A2232A003BE9C12BF2BE4F7899F26145867AF2636603D54E1CC441DB5A13BC6DA42AFD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2