Extracted

• • Target
    92b635c0bed42b1ff4a5aeb586decb5115710ff4f6f8f81f12f6bc7fb9c07064
  • Size 45KB
  • SHA256 92b635c0bed42b1ff4a5aeb586decb5115710ff4f6f8f81f12f6bc7fb9c07064
  • MD5 2f91fcb9ef1bb61f8375d03f72ff98ca
  • SHA1 af522e8cac3db8efe66776818cc1f271db8a98df
  • SHA512 113954c33b9c8289b2258f0fac9e9d7323b49ece980e9086fe9f2261806b1486e969f47dd9628e82b0701946fb06dad14242f96235b7168eb2059567b8888f59
  • SSDEEP 768:EufspTfzcR6uWUcb+wmo2q9Ewz/y3qiPI5zjbAgX3iy0E1XrolqC50BDZsx:EufspTf2g2v0h53bnXSymlqvdsx
  • TLSH
    T11E232B003BE9C12BF2BE5F789DF26145467AF6733903D5891CC4119B5623BC68A42AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2