Extracted

• • Target
    95cbca7a3b7ff07b41a274fa73a25a0ebe8ddb43f043dcc3175d7c03158242fd
  • Size 45KB
  • SHA256 95cbca7a3b7ff07b41a274fa73a25a0ebe8ddb43f043dcc3175d7c03158242fd
  • MD5 49ff0968850c1afac15bc6992789bb59
  • SHA1 30db631e77d45b20fecab49d0d3902ddc913c0ea
  • SHA512 ccab11cff6c9128a242d271a343345c46f9de286c9ed9bb6448163f3acaedd222e42c078a2a1e077b44f0359a9657ed142896a651f0078190bdc4d00c91eb153
  • SSDEEP 768:5udApTNctooWUS7C+mo2qt0COtTMtPIjzjb9gX3iQMMDylCuzdHPBDZ0x:5udApTNmU27Rvj3bqXSQVDkCMdZd0x
  • TLSH
    T19F232C003BE8822BF2BE4F78A9F26145857AF5677A03D5892CC441DB4623FC696427FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2