Extracted

• • Target
    9286b5d7eed1621f9d704c0e5de09648a201f76beceee89658b1d6981edc3648
  • Size 45KB
  • SHA256 9286b5d7eed1621f9d704c0e5de09648a201f76beceee89658b1d6981edc3648
  • MD5 f95ba8a4a1420922ec17d4f25357f389
  • SHA1 93e674c5f5497434a5f587088d0c51e37ed9064b
  • SHA512 af4ba19383ddb32c2542be74b116b2d7cc74fc36a20dcefd2e686a08988b8f4553eee55805f5303a2c91099ed279260e2f28a121e26d55109b6f5e2fd3f2c886
  • SSDEEP 768:QuflpT8AkKuWUch7wmo2q9Hozfy3CKPI08jbxgX3iKAkSVldLoBDZTx:QuflpT8Hv2pTR0Mb+XSKANOdTx
  • TLSH
    T164232B103BF8C12BF2BE5B789DF26145867AF6633603D58A1CC4119B5713BC68A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2