Extracted

• • Target
    99788811f3c33f44ef234a27c0df39e8f7980ed551a83b3107ebdad5c908a87d
  • Size 45KB
  • SHA256 99788811f3c33f44ef234a27c0df39e8f7980ed551a83b3107ebdad5c908a87d
  • MD5 25bf21cbd42ef1fca19ef89286b4b006
  • SHA1 bea7b82dbf014ae7198979d68b535b3c54fbd779
  • SHA512 4a017b328fbc08f9b41a46c4c403c64d1e9537058c02302856e95d42a37ec27e34c02e252fc0d9c7a02f9b4efeada9f32d0f16fd4836ae4a1da8cdaefd56ae2f
  • SSDEEP 768:ku40ZTX3uXTaWUgzW0mo2qwweeXKNopRr8/nPI6nzjbAgX3i10zi2BDZMx:ku40ZTXEb2deQgRrKA6n3bnXSrYdMx
  • TLSH
    T131231B003BE9C12BF2BE4FB899F26145867AF6633603D54E1CC451DB4613BC69A42AFD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2