Extracted

• • Target
    638bcf5930ee217e5544221e2b93c580472626b6eb4012c6e8aeee4cbb430411
  • Size 45KB
  • SHA256 638bcf5930ee217e5544221e2b93c580472626b6eb4012c6e8aeee4cbb430411
  • MD5 6e6b71176d30ba512243f434adcf62b8
  • SHA1 a91d960be26d83458db8b7c1bb1c4cb94a4ef789
  • SHA512 83721f6a79277ae39ab90d1db6934a28ead833c63354cb3d06450826c37d6e91c5faad2743dab693a52897410292345c297ce1d58d3d7a17f4ddfcb888e7be88
  • SSDEEP 768:RuxkJTVmU5EkWUGMKSmo2q1zGsGx8OHuPI2zjbagH3ijqn5U/CgDOBDZcx:RuxkJTgip2+ez323bNHSjqEUdcx
  • TLSH
    T17B232B003BE8822BF2BE4F78A8F26145467EF6637603D9492CC451D75623FC69A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2