Extracted

• • Target
    90de59d483771a1bc0ea73f94f223cded475343559175272ec755adff67c4fec
  • Size 45KB
  • SHA256 90de59d483771a1bc0ea73f94f223cded475343559175272ec755adff67c4fec
  • MD5 93a3099cbeab64a5dee9a9c0e79e7b21
  • SHA1 9c4fcf4458087ca82cffd8be3a7e7e9cbff99f16
  • SHA512 e3a2a0ee1b03dcd4e74c07b8bd8d45f14c0712f4fc2482e3eb72b5778ab54f7c6579f504fddd8bc979ecd454d040c3c9eaa2d55a5b0ac7dbc0e03c940d989336
  • SSDEEP 768:0uPrpT/LGKeWUszuAmo2q9FO5QPCBAPSNjPIRzjbcgX3iQ+Riou163bb8OXPlp7e:0uPrpT/qY2UO5svSKR3bzXSQ+wo53ftg
  • TLSH
    T12F232A003BE9812BF2BE4F78A8F26145467AF6633603E6491CC451DB5713BC6DA426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2