Extracted

• • Target
    64972a6bc8ffe74920575cd72105229c2841b6847eae50ab35b0883fdd381560
  • Size 45KB
  • SHA256 64972a6bc8ffe74920575cd72105229c2841b6847eae50ab35b0883fdd381560
  • MD5 f1d1b8ec9bc8710e0528bed2ae4205ff
  • SHA1 7877b7abbaf04c7aa76b2e66f50f9d5ee4aa7cd9
  • SHA512 d3c043e903416ed5a4706d36c934bd3bbd09786cf32fa018533ac00d229dbfff85e9a062882968b067a0f803b948a3ce7bff7e3aa828cf1c5dfcea2c0b604afc
  • SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFw3HO4SNMOPI0azjbugt3i4Cgujd3tPABUSFBDZEx:MuLAZTnbg2R+JM30a3bRtS4WdErdEx
  • TLSH
    T112233C103BE8812BF2BE4F789CF26145467AF6637603D68E1CC451DB4713BC69A426FA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2