Extracted

• • Target
    96fb66c420ca9adb159012353b0e5fb57e1d27b541e341d77ef1015caccd0d4c
  • Size 45KB
  • SHA256 96fb66c420ca9adb159012353b0e5fb57e1d27b541e341d77ef1015caccd0d4c
  • MD5 8cc528e2b686237620b78f54a0468090
  • SHA1 34293e235febdd5c3ae02897ae7c9bdfd9631b4a
  • SHA512 4a195ca859713c44dd577c6cd7494b19262a3478dea28452fe5eed09e7c7c6a0886ef7bc8f04e510fed86efe821c192a4ee8995f2d2d61d69493edca9f10f105
  • SSDEEP 768:RuxkJTVmU5EkWUGMKSmo2q1umaPcl83APITpzjbsgX3i3Opb4G5pB36/JBDZcx:RuxkJTgip2PfcS3lTp3bjXSYBpB36/Xs
  • TLSH
    T1D6232A003BE9812BF2BE5B78A9F26145867AF2637603D64A1CC441DB5713FC68A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2