Extracted

• • Target
    69ae3877f14264e09d21b58e7ed1c416f8c5413617f6cca9f0333e6cebef0428
  • Size 45KB
  • SHA256 69ae3877f14264e09d21b58e7ed1c416f8c5413617f6cca9f0333e6cebef0428
  • MD5 96a297915b6cd8d387ff194598613a54
  • SHA1 7f304a8fbc2753c35b2227786bac87594ad033cf
  • SHA512 13266d28f02d77339f001022b19c3387896e9b36bf3f176d43df2898ff9fb410a86b48b155c56f9bdc524ec757f6041fccf72027e6beb63ab8240b13fe4da594
  • SSDEEP 768:cu6RaepTPYzbs8WU+Xaamo2q1hBz5U4x7PIggjbNgX3ixhuxXNJ9BDZUx:cu6YepTPso28j6gIbaXSxkHJTdUx
  • TLSH
    T1DF230A103BE8823BF2BE4FB85CF26145467AF2636603D54D2CC451DB5623FC68A526F9
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2