Extracted

• • Target
    65bdfa562e1cbb001af2b205348093e6b475af9a0e8f9a9d45b71a4793c22895
  • Size 45KB
  • SHA256 65bdfa562e1cbb001af2b205348093e6b475af9a0e8f9a9d45b71a4793c22895
  • MD5 ea5f27e2d5434521066b92111a3cbf0b
  • SHA1 635efe232c0e2eb425d34ad4b358eb0a6f1139ae
  • SHA512 7f3c00e68301e58cd62a8ed13b06e733092285b319983ce13976187e424fd1e95025d15adcc68c0888c0da8ca7da39e3df185c673d6e5fec17468681d893570b
  • SSDEEP 768:cu7m/5THrq+CWUoDuMmo2qFKNd3u40cMOPI08zjbzgXUiN/57hPyO27ptnwqRgEE:cu7e5TH2A2R8+M3083bsXxn7sO2ttwYo
  • TLSH
    T18D231A003BE8812BF2BE4F78ACF26145467AF6637603D54E1CC451DB5613BC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2