Extracted

• • Target
    64a6a167cdd1f043e1d2ca925d69d8acef498f57e2487cecfb0b165d3efd7501
  • Size 45KB
  • SHA256 64a6a167cdd1f043e1d2ca925d69d8acef498f57e2487cecfb0b165d3efd7501
  • MD5 40a2c255c0bd626ff5980acdc052295a
  • SHA1 3e21bc0f2f37045acc2e5faee2d8180ac8554938
  • SHA512 2efd1983afbadef197c7299c3f206829a84811878577f93beb1d114b23a2e298267d1813f33465af48d3d7c1e1d7418e80d30d92cbefe3fa988927364c0bfcb3
  • SSDEEP 768:wuDWZTpw7bmaWUg3gSk0mo2qlcNd3u40cMOPI04zjblgXWijOO+WFRYqBDZMx:wuDWZTpMZSB2r8+M3043biXfKOQ0dMx
  • TLSH
    T1C9233A003BE8812BF2BE8F78A8F26145467AF1777503DA4A1CC451DB5713FC69A426EE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2