Extracted

• • Target
    64354ed1c76c778dbdca5404d743a690cae4e99b7b00c738b0b70d5b4aa3ed5b
  • Size 45KB
  • SHA256 64354ed1c76c778dbdca5404d743a690cae4e99b7b00c738b0b70d5b4aa3ed5b
  • MD5 a7a44f6f0a5f24ae9a12117f5199cf6e
  • SHA1 a095efbe1e7b74ad6351ea294b2b98b4826b10f7
  • SHA512 73b2e877a5b9da578f413ae94eb230e1ab384cb33d67e7acd1d2b1864bffc7c9bd4b2264381bed0057f4ab80c9cac606f09d38e632a3289e0e1fd6984d1c933a
  • SSDEEP 768:wuZ8pT1Uu4/cWUeT66mo2q1/8kLyuObvtkjZPICzjbrgXwic9amtN8iBWXujAJhu:wuZ8pT1tc2W8LuyyjWC3bUXNEBV+fdMx
  • TLSH
    T1962319003BE9812BF2BE4F7899F26145867AF6632603D54E1CC441DB5723FC69A42AFD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2