Extracted

• • Target
    c94e72e19bfb7bdde71f6cd681331fa69baf69bf9e9a32f7c255b0394c39aad1
  • Size 45KB
  • SHA256 c94e72e19bfb7bdde71f6cd681331fa69baf69bf9e9a32f7c255b0394c39aad1
  • MD5 99ac02abe6c8293b4612c9f2988a25fd
  • SHA1 5b5c36064d7497715d10c39994cd1444926ad82f
  • SHA512 0d2faed1615ad57d091470e01eff9816e83e2d42c6bc14dcb7d573432308dcd1e6a41017fe9d12024193b54599a4008a6970a7eb3cc1353600fc834dbdbafc75
  • SSDEEP 768:suJdpTP3tcsWUODmqmo2qV/FpPklON8APIDzjbLgX3iabBoaI1oNBDZkx:suJdpTPdI227kwN8lD3b0XSabB1eSdkx
  • TLSH
    T13E232A003BE8813BF2BE4F789DF25145867AF6636602D64A1CC4429B5623FC6DA426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2