Extracted

• • Target
    81bc97af3769db4f68272420606f4660a3ab408df1963e10014ddf4c9c59ad4e
  • Size 45KB
  • SHA256 81bc97af3769db4f68272420606f4660a3ab408df1963e10014ddf4c9c59ad4e
  • MD5 9c91a412a108f1353e160bb8f58cf6a2
  • SHA1 4a4949b7b1fa66246153b9029748b0b6fab42933
  • SHA512 3e6cf3ad47e4812eabeb902bb00b816cdb36e60e82a9e66842b169c48bdf24ed59080ef6abc10f324b37fc341dc51a8999c7c12e81d73b7a9630f11a2b10a22f
  • SSDEEP 768:suJdpTP3tcsWUODmqmo2qVtBz3QKx7PIQwjbXgX3i0b5nCfftyHThqQBDZkx:suJdpTPdI2IV0Q4bwXS0b5CfgHTpdkx
  • TLSH
    T169231A003BE88237F2BE4FB89CF26145867AB5636603D54D6CC452975623FC6CA426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2