Extracted

• • Target
    66fd39e25758934f00bfeca4e92820ca48854dd486c8566fc0df85d5898e802d
  • Size 45KB
  • SHA256 66fd39e25758934f00bfeca4e92820ca48854dd486c8566fc0df85d5898e802d
  • MD5 c42330270a57e79fea220cdfa4a195a8
  • SHA1 3c2b0b014fd2df98760d23cd7a31ed2a13e488c1
  • SHA512 9a15d26e848c69b1b41f321623ca42e0a39cf98868a8cc48e3e7359a41500c00f1946898176c99a4622251df3f6d68cc2efb2a3148edbabb70b076c4a135342c
  • SSDEEP 768:RuxkJTVmU5EkWUGMKSmo2q11BzwQ/x7PIPBjbAgX3ikiOnck92zqKBDZcx:RuxkJTgip2AaFPRbnXSkiO+GUdcx
  • TLSH
    T115231A003BD9823AF2BE4FB89CF26145467AF6637603D54D6CC412DB5623BC6CA026F9
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2