Extracted

• • Target
    693e2576ef1a3a3e07a276149057f780336903aa5b9ea678d94ff45269661fff
  • Size 45KB
  • SHA256 693e2576ef1a3a3e07a276149057f780336903aa5b9ea678d94ff45269661fff
  • MD5 fb9deb487ef0e1fbe3aa60dd781f4980
  • SHA1 b68239e6208ced232d544c6e8de50470006765ef
  • SHA512 a8d0aa3c4a5dd5f450b53866b8f12474342ade7b323729301fad259e146a7b3b4bf94c5e40017af957c05d1c31b66f200ab3a57441db31be5f81c1b81cbe4c3f
  • SSDEEP 768:4uBfJTMUyYUWUWBDimo2qVvL5P02FUFdxYkk8PI2zjb0gX3ihQALa5oytasFkBDz:4uBfJTMpv2CLDmWB23bbXS2ALivFSdbx
  • TLSH
    T10F231A0037E9C12BF2BE4F7859F26245867AF6632603D54D1CC451DB5723BC68643AFA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2