Extracted

• • Target
    62892d3a0f06e952115a8b0686e948d210d60802458a32c075dc66d9d0021257
  • Size 45KB
  • SHA256 62892d3a0f06e952115a8b0686e948d210d60802458a32c075dc66d9d0021257
  • MD5 fd67f28257ee6b70ab6f71cafbff1499
  • SHA1 df0081e4f5674904e9b3fdad9c745da72d9804da
  • SHA512 0bddc55fc50f04ee62d4cc0ab9e9045caaa9e89ca9e7048ad2692033bd9a31affda71e10132a74cb3b30b0702911d63895f4f857b1255ae1d6f89f3cedac02ad
  • SSDEEP 768:MuBGJTP0BQ0UWUWHaimo2qVe0ewtDc30oiZPI/zjbUgX3iWiRVQrQUP/9MBDZEx:MuBGJTPho2twR2iW/3b7XSVe/wdEx
  • TLSH
    T1CF233A0037E8C12BF2BE4F7868F26245867AF6672602D5491CC451DB4623FC6DA53AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2