Extracted

• • Target
    661045715254f8419e35d8c7cf090267893c01e65e351a6dcc7de069b823b489
  • Size 45KB
  • SHA256 661045715254f8419e35d8c7cf090267893c01e65e351a6dcc7de069b823b489
  • MD5 59978bf828e019fd5482224f1b49f577
  • SHA1 be4370d1144cf7ca82bdb29372726bf0be914482
  • SHA512 f537fe503065f2942f343829c1d5fcceb9530f33f6c3016bfb055258d5c2e0f78336e34c469b399f6abd4e651217b0534417a76dfe9a851bc6b70a007acf32f7
  • SSDEEP 768:EulCJTHESwgWUK3aGmo2q9nDEbHBqj2OPI/pzjbLgX3iKRMXushBDZsx:EulCJTHl42IyoK3/p3b0XSoydsx
  • TLSH
    T178231B0037E8C22BF27E4F7898F26145867AF6673603E6491CC451DB5613FC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2