Extracted

• • Target
    55b3f4b9abf68fd0534e4dee8e457a91ab8197d3bbd7ebf0cc3e73e01c4964b9
  • Size 45KB
  • SHA256 55b3f4b9abf68fd0534e4dee8e457a91ab8197d3bbd7ebf0cc3e73e01c4964b9
  • MD5 95d64044c0936bccab7cd28c2115904e
  • SHA1 820091933612026096e4267f704a5b913d151da8
  • SHA512 f34ae5cbfd7a39796fc5bf37a15be50db3a9a6508fc5833707f2cc6370b948cba557fa90f7d3d4d0792943031aaf731e322c185512d92276aa82bec52cc27b32
  • SSDEEP 768:8uuSpTg7GBoWUSH6+mo2qYhoRQKIJOPIhzjbigz3i8gjgLfF3299APBDZ0x:8uuSpTgyf2JYxg3h3bFzS8QgR3Ssd0x
  • TLSH
    T1CD233B0037E8C12BF2BE4F78A9F26145867AF6633602D54E1CC451DB5713FC69A426EE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2