Extracted

• • Target
    80c6fc4f3417f858bddd2dd67ef31295f3cda4ff3e85d884bacd1ca2e96f7654
  • Size 45KB
  • SHA256 80c6fc4f3417f858bddd2dd67ef31295f3cda4ff3e85d884bacd1ca2e96f7654
  • MD5 ce0ea041942ad18ee0251925a8a39246
  • SHA1 ae2ed4fc2b8a2b78b527ecc8213615cb742791da
  • SHA512 4b2dd8cd5e7e6dcec8a146e373be6ff411e4e54c032fb47561419f5b7f8e63430f20cc2793b5d22b356ed417f1a2ee61d8de70d3727abd808ce015660b6fc05d
  • SSDEEP 768:cuR0JTPUYkEWUmjWymo2q1fLiE0yFjrdjYkk8PIuejbRgX3iRFoNUbptPAR7wBDg:cuR0JTPjY2SLBXQBuSbeXSra+ptARSdW
  • TLSH
    T124233B0037E9812BF6BE4B7859F21145867BF5633603D64A1CC452DB5B23FC68A43AEE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2