Extracted

• • Target
    931b4e93e3552329f893b6e136a41e9626d2a9c86969ddb66570d950a7c58e8f
  • Size 45KB
  • SHA256 931b4e93e3552329f893b6e136a41e9626d2a9c86969ddb66570d950a7c58e8f
  • MD5 64f08d126c26ca6d27f324905dbac18d
  • SHA1 33bcf241ba2540aa06fdd120c91f4b8e69d60805
  • SHA512 cb3985a3e292bced8bc448428ff2ed66e8973967950640a8929ca76ba068ba9bb97ed01a29dc46caf45bea6aefbfab1100d13bb8dfc5963bfe23b3ce84a474fc
  • SSDEEP 768:5uSy6pTpwrSWWUE3/WImo2qNrITnyHaaPI0zjbYgX3i79SnE69sCxfKhBDZ0x:5uSy6pTpoo2oE503bPXShSE6vfQd0x
  • TLSH
    T109232A003BE9812BF2BE4F789DF26101857AF6677603D58D1CC4519B5713FC68A42AFA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2