Extracted

• • Target
    618dbf3b697b163a046688af66db1417aad0ffb9220933cc6ed17015f2276fb1
  • Size 45KB
  • SHA256 618dbf3b697b163a046688af66db1417aad0ffb9220933cc6ed17015f2276fb1
  • MD5 4123d197c76a1408cdb77f928adcbc90
  • SHA1 68d7eb0abfa450d3918d0daa9014533c95c4ffc1
  • SHA512 50892df3142e86cdc5dac0933a13f98d5d4b7788d78e0f2c3eb64722c72f2d1cad3176a194f7da435c3705246950e08fc88318c1f16b96ad894522e9b07070f8
  • SSDEEP 768:8uuSpTg7GBoWUSH6+mo2qYh6R8aI3OPIOzjbfgC3ivbhH5BDZ0x:8uuSpTgyf2J+FO3O3boCSTpd0x
  • TLSH
    T1D6231B0037E8C12BF2BE4FB89DF26146867AF6673602D58E1CC451DB5613FC68A426ED
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2