Extracted

• • Target
    640e16289bb06700efc6f18b7848370a83ab497b00fa4c16c54da08dc215b3f0
  • Size 45KB
  • SHA256 640e16289bb06700efc6f18b7848370a83ab497b00fa4c16c54da08dc215b3f0
  • MD5 7f2d4c453530853ea31cf68d736edc09
  • SHA1 85755d39026f3402af4faee4d3897d89d6b97e6e
  • SHA512 659cd8a1aeccbe02a1726594f5e6d8c1296e2f3f547a0381cc24bdf6c482115bf70efc14fed26fffae6457a136f72c3c6af5c6f36cbd3a3ee3c7b408e12f725f
  • SSDEEP 768:0u1YJTHwAUgQWUaT2Wmo2q9e/rLzlJAOPIc6zjbPgXoiwqrR+t8YdorCxBDZ8x:0u1YJTHcw2RPp23c63b4XlRrR88YdoWk
  • TLSH
    T11A230A0037D9822BF2BE4F7898F26145867AF6673603E58E1CC441DB5613FC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2