Extracted

• • Target
    ee6688651b50cd79ecfa51e21b50c926928696972b965e4172a4df672b07310d
  • Size 45KB
  • SHA256 ee6688651b50cd79ecfa51e21b50c926928696972b965e4172a4df672b07310d
  • MD5 176a9bf19bc2e4736e476ad7b2d6724a
  • SHA1 953ff4742b80278181b55e6003d321344288a3ca
  • SHA512 4a65e0712aefd1996799fb8f02a0f920cc99d101e2af491467d0cb9fd989b32a465096d2ddaa9ac07c192de587649f835c22996921f39efb9cc5b42b9e72752c
  • SSDEEP 768:MuBGJTP0BQ0UWUWHaimo2qVyLiE0yFjrdj3kk8PIhJjbIgX3iSzsOqt/1F8DNcNm:MuBGJTPho2/LBXDBhpbfXSrOW1aDaDdG
  • TLSH
    T182231A0037E9C12BF2BE4F746DF26145867AF6732A03D64A1C8441DB5B13BC69643AFA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2