Extracted

• • Target
    69c327edf3eb6e7cd9c9562394daaef7921118ee669b2cd78b03bf12252f65ab
  • Size 45KB
  • SHA256 69c327edf3eb6e7cd9c9562394daaef7921118ee669b2cd78b03bf12252f65ab
  • MD5 ca4905e52aa9de3b3f9be85a99ee249e
  • SHA1 e0ad95dbfc2cef8c16405d9f536a9edb999197ee
  • SHA512 27d47c31d21bcca6b181faa3572dcb708f47871e32e5283039572af1b56be77ab218871245d8cc16f0fbeaadf71617b059afad2524cf762afc5dac63654c82a7
  • SSDEEP 768:EufspTfzcR6uWUcb+wmo2q9r9wScq/z1OPIszjbHge3iYP+mj6TFWcQgq4UBDZsx:EufspTf2g2mi9K3s3bAeSYWmj8FWcQXc
  • TLSH
    T1E9232A003BE8C12BF2BF4F78A9F26145867AF6633603D6491CC451975723BC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2