Extracted

• • Target
    d6fe70ce8bb87d5e97abd2890acb8646187af2ddaa02fcfdc7581cd3630f5f10
  • Size 45KB
  • SHA256 d6fe70ce8bb87d5e97abd2890acb8646187af2ddaa02fcfdc7581cd3630f5f10
  • MD5 88f022971dad41f2a68ebbbfea5fc3eb
  • SHA1 b121528789a37e3f71d76f4f9bf03bf9283e8cf9
  • SHA512 efadeb5535239f7b3feeeffceb307e702e8084fa115f5251db1fd46b547e20ac07b92137e90113ddd672444e585371ba689c03702e8d4703c46e79d7293ae42f
  • SSDEEP 768:cu7m/5THrq+CWUoDuMmo2qFV3xY6AZOOPILzjbjg43iKArb30iz2m/IG5BDZUx:cu7e5TH2A2kulO3L3b84Sl8+/XndUx
  • TLSH
    T141232B003FE8C12BF27E4F78A9F26145467AF6A36602D54D2CC452DB5613FC68A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2