Extracted

• • Target
    0654f898c93579b4c714842b32c2c2f39b1481096ab697151a7fadb6db659e59
  • Size 45KB
  • SHA256 0654f898c93579b4c714842b32c2c2f39b1481096ab697151a7fadb6db659e59
  • MD5 25b3866c38da9c9d551f46e4fbf38f22
  • SHA1 0d889bfc2395981cd1086bec2b0771083cd375a8
  • SHA512 77d3eb6e4a05252337df1c926ba0da020f7f7c2cc777166e21f4c7954e6f2835044ee1694ce933b54b6092c3b79e01c6d623871c9e7625bd353da74b34678087
  • SSDEEP 768:RuxkJTVmU5EkWUGMKSmo2q1ZxJaxjwHuPI+zjbagR3i0Ywpd7P23XVhBDZcx:RuxkJTgip2we+3+3bNRS0b7Oxdcx
  • TLSH
    T15E232A003BE8822BF2BE5F7898F26145467AF2637603D6492CC452DB5623FC6D6426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2