Extracted

• • Target
    92f6bb4e07b194e3ebcd97936850a54f49cdcc16af1986c7545b2db94c2c87c9
  • Size 45KB
  • SHA256 92f6bb4e07b194e3ebcd97936850a54f49cdcc16af1986c7545b2db94c2c87c9
  • MD5 4876d2f12bccf7ac35e663b316d53286
  • SHA1 7ccf8dbeb2be14159b74c7dcc9f2656da9c1e40c
  • SHA512 cfc6feed2bf37f3323df3ad91bb4c076dc58874e497209f8fcd20a338cd1580ad9d4b9efe977ee84ed7b6a8d8f6d62fd2a50ddd6b2aa400db962270302f30176
  • SSDEEP 768:cuqb5TrIGuCWUoKXMmo2qQ+eeXKGoibbb6tN8/nPI6DzjbJgX3i+jhYwE2jUkzB0:cuqb5TrhG2LeDqtNKA6D3bGXSanRVdUx
  • TLSH
    T145232B003BE8C12AF27F4F7899F26145867AF2732603D94A1CC4519B5723BC69A526FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2