Extracted

• • Target
    629388bcc063c76b6b99a68b096dcfc95681dc54ee5ed16ad3809a180f37173c
  • Size 45KB
  • SHA256 629388bcc063c76b6b99a68b096dcfc95681dc54ee5ed16ad3809a180f37173c
  • MD5 26e8209e5a8eddcb46a30d1220321927
  • SHA1 bf5745de18cbb9bf2d22a26006567ae72ac489fb
  • SHA512 c47f74050c101873b7e5a6fa1831bda0c0ae4ee9cd09a41fcf52664bb8e6acd5c7a11a05142ec00c0a6a1a1091ecc690c46dab879e54fafaa18494d8d7a07ef0
  • SSDEEP 768:4uBfJTMUyYUWUWBDimo2qVg0ewUkA1MiZPI7zjb2gj3ifeTUgCIqS3LSMBDZbx:4uBfJTMpv23wvDiW73bpjSfm9bdbx
  • TLSH
    T1F6232B003BE9812BF2BE4F7869F26145867AF2633603D58A1CC451DB5713BC69A43AFD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2