Extracted

• • Target
    97c2e4e55e09e7e2ebfe770660140069c9711ae086cf757ca7d921edd94d3595
  • Size 45KB
  • SHA256 97c2e4e55e09e7e2ebfe770660140069c9711ae086cf757ca7d921edd94d3595
  • MD5 c368d80b7a5b3743bedd26cc1726eac5
  • SHA1 c8c69b2fab602b625244e433ec2a25a8a62efbef
  • SHA512 b5cc5e73a00bb1d4be639acc18ad982313e60cc70e3b507425031d5f5adf414dc35a2d6eefcb8c8041638c36801cfe9fa2034522afdc205b2a3e798316d87273
  • SSDEEP 768:UuKWgSJTwU6NkWUGnaSmo2qAjT2Qpm7PIKPjbWgX3ijTwzsHdJBDZcx:UuKWgSJTwRf2GeK7bJXSjKsBdcx
  • TLSH
    T1EE232A003BE9823AF2BE4FB8ACF26145867AF5733603D5496CC4519B5623FC6C6426ED
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2