Extracted

• • Target
    910cf363c87b12a27685ff4511c7dc4f111d45e52415776b500b64907979508f
  • Size 45KB
  • SHA256 910cf363c87b12a27685ff4511c7dc4f111d45e52415776b500b64907979508f
  • MD5 c0cbac696e447faa8961a66da14b87a9
  • SHA1 f6b14741b113e5418c637cd0efd1d17da82ffc5e
  • SHA512 2bf61d7aba20c0f5da8e08953ebbd94c07294c9b7549e44dcb4a70f2187a367318745b8b609b1f5916e8fd0f1b49166ac9972a984bd156cbf88f858d6ef70296
  • SSDEEP 768:MuBGJTP0BQ0UWUWHaimo2qVJpt0CCM+d4CvS8PIMFjbmgX3iGBEaUD5PDFBDZEx:MuBGJTPho2Q/CFWBMNb5XSVD5PndEx
  • TLSH
    T1E3232B0037E8C12BF2BE4F74A9F26145867AF5733603D64A1C8451DB5A23BC69A436FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2