Extracted

• • Target
    91b3d21cab66aaff9904bcf5999b2daa98582d1212d4ebe6d986d56670e7f4eb
  • Size 45KB
  • SHA256 91b3d21cab66aaff9904bcf5999b2daa98582d1212d4ebe6d986d56670e7f4eb
  • MD5 be5c54f374018b27c4e1f5f660a48eb2
  • SHA1 5c32aaa97d968ddd2b83287d389ccbb29f288b47
  • SHA512 407880d3e5b31d34bbbb4757104308329172baaeb5892f49569c2e4e6a9f36ab3d7202b9c77d1db59155abdf8a797a0746c4b9c879c583632b89d70c0990f9d6
  • SSDEEP 768:FuxkJTVmU5EkWUGMKSmo2q1v0UwPOlehAPITpzjbBgX3izm18x+OQBDZwx:FuxkJTgip2G0/OghlTp3buXSzqY+OGdi
  • TLSH
    T16C233B003BE8812BF2BE4F789DF26145467AF2637603D64A1CC452DB5713BC69A42AFD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2