Extracted

• • Target
    641c9eddc96c7a600df031cea8b68bf18c1508004e8fd718c3b3ac10c42f48e7
  • Size 45KB
  • SHA256 641c9eddc96c7a600df031cea8b68bf18c1508004e8fd718c3b3ac10c42f48e7
  • MD5 076e81729ce6204c0891fa4bfeed9673
  • SHA1 6329f9867cc59968fd8ffbd907fb4531f7ddb4a7
  • SHA512 e8262f0d6b3d45038b1fc2a236134a6db90a91419314be4fabbe3801058cd78b6649721a25c8f54afe9e088bbd251e27c6384d602f78d94afb883efd6c8d735d
  • SSDEEP 768:kuSOpTPTCFcWUeXa6mo2qAm8kLyuObvtkjZPICzjb8gXDiZQ3QmOTQ0QZPBDZMx:kuSOpTPOP2W8LuyyjWC3bTXe4TaQP5dO
  • TLSH
    T1CF233C003BE8C12BF2BE4F78A8F26245867AF6633603D5491CC451DB5613FC69A42AFD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2