Extracted

• • Target
    64f6279ceef76a285cfdccfd8270b8756c7240211ebcb1e7a9dfc67c97286c1a
  • Size 45KB
  • SHA256 64f6279ceef76a285cfdccfd8270b8756c7240211ebcb1e7a9dfc67c97286c1a
  • MD5 b792811efda581f81eda45d810537d14
  • SHA1 2d15becf3e03b71223ffac5603c0e7f8f1856dec
  • SHA512 89675875542f60addda559f6fd61294acdfdcac6414fa79025f9d199c989c235abc1335221f0b97dfda300b73590be594450d5a0b48786af85f7b33e10621707
  • SSDEEP 768:EulCJTHESwgWUK3aGmo2q9ORzMwnOPIZzjbAgX3idNExlK3fmDTzBDZsx:EulCJTHl42PA+3Z3bnXSnYlyfqpdsx
  • TLSH
    T14A232A0037E8812BF2BE5F78A9F26145867EF2673A02E54E1CC4519B5613FC6CA426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2