Extracted

• • Target
    99ebe41472efefe3473d87b02e8f0c78a1b4c38010b4d187cf33700306369c58
  • Size 45KB
  • SHA256 99ebe41472efefe3473d87b02e8f0c78a1b4c38010b4d187cf33700306369c58
  • MD5 050dc9412c1363c29f58bf91bac9d8ec
  • SHA1 6dc17659e34411a00d5770bc17521bf6ea042f75
  • SHA512 17159c052ccb3751521138b8c9f1099be856f0fe35a3110c8af10e8ef5198dae1e17ea62ca06aa9dda797abeb101a2208c87297b8d061a9ba6a3ae53a753953f
  • SSDEEP 768:EufspTfzcR6uWUcb+wmo2q9o9oyvinXPIp9jbCgX3iELAQWborS6ToVBDZsx:EufspTf2g2daC1pVblXSOsy+7dsx
  • TLSH
    T135233B003BE8C12BF2BE5B78ADF26145467AF6633603D64D1CC4119B5A13FC68A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2