Extracted

• • Target
    67d7d07846a6a93dc6a2abda80956db617c1169950a797948956a97214faddfe
  • Size 45KB
  • SHA256 67d7d07846a6a93dc6a2abda80956db617c1169950a797948956a97214faddfe
  • MD5 b5ad12c080067cb89580d0a079369e05
  • SHA1 c852f7b5c98f9f7a9d8d7a30690a3db56819b2fe
  • SHA512 f82b5a398bc432dd8bd537d07deae7725579d72ba7f89853d9efc29133a2e974e51c14c31a92a812678f3e32c2638d54e853f7742455d4d71849b9a19bfcec25
  • SSDEEP 768:8uUIpT4vvofWWUEXb+Imo2q4ziD8yfzuOPIlzjb9gX2itLwsk/AeMLqBDZ0x:8uUIpT4vAj2niAJ3l3bqX/lwsk4eu0d2
  • TLSH
    T132232B003BE9823BF2BF5F7898F26145467AB6633603D54E1CC4529B5723BC68A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2