Extracted

• • Target
    65f4e0f683e089291400a00af888ae5b45d2f196d7320b0c07edc79295d03afc
  • Size 45KB
  • SHA256 65f4e0f683e089291400a00af888ae5b45d2f196d7320b0c07edc79295d03afc
  • MD5 cf90f3bd51f74dcae0c653dca30474f9
  • SHA1 25aa87e67fb8d6f5b2ba9266f7b818ebd7e5ec5d
  • SHA512 613270c743abdd1df3c91ab043bdbf991c66392c502a35dfa339f74b0a122d5db3dd6a5bc2ff83f3c12a794efba9ee12f06315f1ab2c831c633159eea25a5201
  • SSDEEP 768:MuBGJTP0BQ0UWUWHaimo2qVdcP0pycvHPIjzjblgX3ilOaCB6TKztplBDZEx:MuBGJTPho2OccMcvgj3biXSlrDT2thdG
  • TLSH
    T102231A0037E9813BF2BE4F78ACF26145867AF6632603D6491CC451DB5623FC68A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2