Extracted

• • Target
    97d31d2aba063d3ea97010edc76676c2a5514c0692f682977f8fad8047af3838
  • Size 45KB
  • SHA256 97d31d2aba063d3ea97010edc76676c2a5514c0692f682977f8fad8047af3838
  • MD5 b747d1f759ccefe840243c9dfd981265
  • SHA1 bbc6a83c7c7a011ee6c49a27da2428dd843f4e71
  • SHA512 f4c33f3e68b1c32fd29f891effd1afbb3b69cc7bb6daad5b4214dff9e52e7fb76e3ae45de36e568e2ee2d8d07706ed7af78744cfb3388b652dadec5660b50c5f
  • SSDEEP 768:suJdpTP3tcsWUODmqmo2qVPmaPol53APIkzjbmgX3ia7Ew+1nkvBDZkx:suJdpTPdI2efob3lk3b5XSnwuadkx
  • TLSH
    T128232A003BE9813BF2BE4F78A9F26145867AF2736603D64E1CC451DB5613BC2DA426ED
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2