Extracted

• • Target
    766c8305bb251e46b6ac58898b7e2b8dd9cf38da6036c4e251fc0b6252e8fda1
  • Size 45KB
  • SHA256 766c8305bb251e46b6ac58898b7e2b8dd9cf38da6036c4e251fc0b6252e8fda1
  • MD5 686af8118e09a3ff9ee8934874c7ea98
  • SHA1 62b5226a8a2365a46cbaa4ee0f021f2394042f86
  • SHA512 68392e57009eae31305eb2cf2f0828df6114382d5344de1dad59a45cd6f76f5696fc693e9880cb62381a001ab6448251a278fe45cd8ae0c7a34360c8c95fc7cd
  • SSDEEP 768:kuSOpTPTCFcWUeXa6mo2qAh4ovHpU1cPIyzjbFgX3iVN7e2ayBYBDZMx:kuSOpTPOP2x4ofC1hy3bCXSbayEdMx
  • TLSH
    T163233B003BE9812BF2BE4F7899F26146867AF2636603D64E1CC441D75623FC6DA426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2