Extracted

• • Target
    64a73d29744ffdabc507a08d17e6ce998a5d7ba9c9bd80e5a378ea506689ef30
  • Size 45KB
  • SHA256 64a73d29744ffdabc507a08d17e6ce998a5d7ba9c9bd80e5a378ea506689ef30
  • MD5 2f2462bff012fb7215dc6b34780b530e
  • SHA1 eb21de5293620d160aa2196dc2de5bcf75cc3870
  • SHA512 cf4022404111caaef88f7712c69e4cf60eb9096d1f2d27be9c586c633b1dbf69872d91fe77b800180cb2940f450727bec1dc3f2b5cfc90d54aaa14816d85cae1
  • SSDEEP 768:5uSy6pTpwrSWWUE3/WImo2qNrzjHy/aKPIbujbzgX3iM38vGQ5ojNBDZ0x:5uSy6pTpoo2onhbCbsXSqSGQijDd0x
  • TLSH
    T166232A0037E9822BF2BF5B789DF26145867AF5633A03D68D1CC4119B5613FC68A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2