Extracted

• • Target
    97ef572848d741e35aad269d7cf5db077ef6664f340602d1dd922daeae11aeee
  • Size 45KB
  • SHA256 97ef572848d741e35aad269d7cf5db077ef6664f340602d1dd922daeae11aeee
  • MD5 3928c54838bde15c1d81dda74af813a7
  • SHA1 f9c97250fec3c89c6f88da8fce65d4e69688e2a8
  • SHA512 27957360374d60a9aae5635ebf88f53a27fecfe57c3e82549634a746b12405a37b3bc0b7a30ccb56f6af0010029f4aef40b28c1d8b69ba9b36881e4e4d0072b7
  • SSDEEP 768:0uPrpT/LGKeWUszuAmo2q9FO5QPCBAPSNjPIRzjbugX3i36uQzwgHuiCREGYBDZ+:0uPrpT/qY2UO5svSKR3bRXS363ztOR6e
  • TLSH
    T173232A003BE8822BF2BF5F7898F26145867AF6633603D54A1CC451DB5613FC68A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2