Extracted

• • Target
    64f136e952e44eed88a1d09ca376529fa9dbebef02be088f4b6ec4fb0c9343ff
  • Size 45KB
  • SHA256 64f136e952e44eed88a1d09ca376529fa9dbebef02be088f4b6ec4fb0c9343ff
  • MD5 cbc15e3132a53519296f17502dadf7b9
  • SHA1 125dd51794d8d89864c905eef88380d71b63170a
  • SHA512 fed96159bfabd0af6ee25b0e14f644fb2ac2f108ac5a74bfc1a5bb2c7a6c5a9d834416fd94dfb0471e30631c329862bca461d8a08d9bf95b996a5c88cee59464
  • SSDEEP 768:suJdpTP3tcsWUODmqmo2qVC/7c83APIlzjb4gX32d/Qm8YSkeCBDZkx:suJdpTPdI2LDp3ll3bvXGWmkke8dkx
  • TLSH
    T178232A003BE8812BF2BF5F78A8F26145467AF6737603D6491CC451DB5623FC68A42AF9
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2