Extracted

• • Target
    a64442b1c87bf2b6140d492e9ab84a81d743e381d247f436a9babd35b20a655b
  • Size 45KB
  • SHA256 a64442b1c87bf2b6140d492e9ab84a81d743e381d247f436a9babd35b20a655b
  • MD5 89c0365b755e28fa5c144782cc5fd3a2
  • SHA1 ae110b3b1ece1d3e89cef06f5afb38f9490c61e7
  • SHA512 058211906bdf06d8062c998a1baa49e112ac14d86edef1f5896c10e2e57e78cfbfd0c52247420a3c7dab3336d360b2b850a6ef04ba8ab18bd819d68e26d522b5
  • SSDEEP 768:EulCJTHESwgWUK3aGmo2q9VCqtTtoPIizjbdgX3iXjV4Yl2/51qsdBDZsx:EulCJTHl42ql3i3bKXSTN1szdsx
  • TLSH
    T1F5231B003BE9C12BF2BE4B74A9F26146467AF2673603D68E1CC441DB5723BC59A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2