Extracted

• • Target
    62c3a52fdb82a759d90e3531eaeada684597cc1a4c1ddd3542913af5c7941bf1
  • Size 45KB
  • SHA256 62c3a52fdb82a759d90e3531eaeada684597cc1a4c1ddd3542913af5c7941bf1
  • MD5 62b58000a56bcd1105fa141c8b869ac6
  • SHA1 ee4f8ce118479984996c5784e664acb5e0aff24f
  • SHA512 660e13b0b03091dba37baf91a0284e263c9caef38ce1ac9c9a4e66efb2f3a5a35738e36410a3a718095d19ccf5259ce783eaf6742d9e63863aec8e20feffce0b
  • SSDEEP 768:MuBGJTP0BQ0UWUWHaimo2qVJpt0CCM+d4CvS8PIMUujbQgX3iI1jgOLQFEl9M5V7:MuBGJTPho2Q/CFWBMXbXXSwJLlhdEx
  • TLSH
    T170232B0037E8812BF6BE4F78ADF26145867AF5632603D54A1CC451DB5A23BC6CA43AFD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2