Extracted

• • Target
    68a6c5cfecf00733317c02ac939b4857114210f6f88c8fca7bad6f0178d9b70b
  • Size 45KB
  • SHA256 68a6c5cfecf00733317c02ac939b4857114210f6f88c8fca7bad6f0178d9b70b
  • MD5 c1973618f7c0bd5b5637823b5bfce9c8
  • SHA1 29b7bf2e168ab05b2c03c9e37d8ce0646aa6e5eb
  • SHA512 5c377505537e2db45ca855079d751053e4f3cd0288f85318cd607c9c84519c134c5ff4fed7aa1973ee7c311aa1ca4f2fdc66222b7efce24dc2ef19167e1e3959
  • SSDEEP 768:8uUIpT4vvofWWUEXb+Imo2q4YQ7PivEPI3ujbfgX3iieXGyZm0rX1fYBDZ0x:8uUIpT4vAj25bk3CboXSIyVfed0x
  • TLSH
    T139232A0037E8C12BF2BE4F78ADF26145467AF6633A03D68D1CC4519B5713BC68A526FA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2