Extracted

• • Target
    92a5823ffb89a96ed10d411f559cefc19cf5a3260277671a7e131571f7390cd4
  • Size 45KB
  • SHA256 92a5823ffb89a96ed10d411f559cefc19cf5a3260277671a7e131571f7390cd4
  • MD5 574e4c81a3fc9918c9678764761cbc2d
  • SHA1 8a259591b9e1e71cb7c67d75b7ed15d695e9c8cf
  • SHA512 f9a889f16639ae41df39f7500497af34856c972f07107230cb27e18da271e94ac383759f08ac9098c90ecfb048bfd095d251dee94036ea764d5b13c5b85db573
  • SSDEEP 768:5udApTNctooWUS7C+mo2qtgDEbHBqjSOPI/Xzzjb2gX3i+AEu8xMEj+VRWbgBDZ2:5udApTNmU2fyoO3/Xz3bpXSnEb6EjSRe
  • TLSH
    T165232A003BE9C12BF2BE4F7899F26145467AF6633603E5491CC452D75623FC68A42AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2