Extracted

• • Target
    67124d2207825c0662dc55e35e91c8f676a0bed4cfb69d81ccba0067585f1069
  • Size 45KB
  • SHA256 67124d2207825c0662dc55e35e91c8f676a0bed4cfb69d81ccba0067585f1069
  • MD5 de7947c05fbb06ebe219ddb823e08863
  • SHA1 0843f6a270ad33d79a5912a02481bf34811d531f
  • SHA512 a063a5a02956a05a720d079c06c07cf46a0ef4579dd7ee1f94bc1efad39a3f7d6ed7b7561671cba2930c162667a5b8cc5c20c71c2ae569325bfdfa664ec6a3a8
  • SSDEEP 768:suJdpTP3tcsWUODmqmo2qVs+GtCV+JtHuPImzjbygX3iJ1Yu0+rr/2uiBDZkx:suJdpTPdI2n+TM3m3b1XSJSu0+rD2uck
  • TLSH
    T1E9232A003BE8822BF2BF4F7468F26145867AF6673603D54A2CC4519B5623FC6CA526FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2