Extracted

• • Target
    90d2e0b1ff0a5c6c92ad483842070a15fcdbd822733acf1f811fc7bfd105b618
  • Size 45KB
  • SHA256 90d2e0b1ff0a5c6c92ad483842070a15fcdbd822733acf1f811fc7bfd105b618
  • MD5 83a4226d72f378c42c40f8c46153312c
  • SHA1 eb078d2df7add7b258315ab6d6ac569291ed3c15
  • SHA512 826ddfcde091311f648e6de99171e7874e9ad9a1566eb1460d6f13e31a970f303bbe7cf8998226368a1cc41a5b0bc22952aad6ae1046bdabba599880cececfd1
  • SSDEEP 768:0uPrpT/LGKeWUszuAmo2q9zwD/y/aqPIJzjbCgX3ilFSk92CobBDZ8x:0uPrpT/qY2QkhJ3blXSekId8x
  • TLSH
    T166233B003BE9C127F2BE5F789DF26145867AB6632A03D54E1CC411DB4613FC68A526FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2