Extracted

• • Target
    094e98d3dc9ffb6e935915009046c8116cda98ad1be2ee79c32f436cff8ea273
  • Size 45KB
  • SHA256 094e98d3dc9ffb6e935915009046c8116cda98ad1be2ee79c32f436cff8ea273
  • MD5 fb51a50b7535aa008dd474344defb0b6
  • SHA1 1c0fe1a450362cd5008a65dd5ae092d88a131592
  • SHA512 3ead5024134492a69d6a94d9dd42fc4bb6acbd454905eecd4fcda5084e07293bc212990fbdd8ea21e31c869790b4d916634f26434772cdd23cfac1a9804f9640
  • SSDEEP 768:8uuSpTg7GBoWUSH6+mo2qYCDEbHB0jrOPI/izjbWgX3ikNKFnpILXvR6pBDZ0x:8uuSpTgyf2qySf3/i3bJXSUwIL03d0x
  • TLSH
    T175231A003BE8C12BF27E4F78A9F26145867AF6633602D6491CC451DB5A23FC68A526FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2