Extracted

• • Target
    a63716270ef694dc43d8f8cfbf2a23423c737cf1e4941216ba7eaaa898f22880
  • Size 45KB
  • SHA256 a63716270ef694dc43d8f8cfbf2a23423c737cf1e4941216ba7eaaa898f22880
  • MD5 c8c6b3bcdf12ee693d4adbde8d051c4f
  • SHA1 b66e87a4dd441fe3cb0263eee9340e83c54b2f4f
  • SHA512 dc4749ed0c4b1de1a1ccdf8bf7bb7c0ca47269a1e38df533db33d49852232a429ded745530ce61d1694add7bd1e896a320e70577aefc9fc0f06998cc80d56349
  • SSDEEP 768:0u2vpTD4U2ieWUsqfAmo2qj4ozfy3CKPItJjbygX3iv6nkNfHl6MmMYEmBDZ8x:0u2vpTDe+22TRtpb1XSvGkdYMSEod8x
  • TLSH
    T1FB233D0037E9C12BF2BE4F789DF261058A7AF6632A03D6891CC412D75613FC69A526FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2