Extracted

• • Target
    95fb86394e67ed2e23354828c1d722666284cb1b238e9daf2d795e10e25b13a0
  • Size 45KB
  • SHA256 95fb86394e67ed2e23354828c1d722666284cb1b238e9daf2d795e10e25b13a0
  • MD5 1331c25d0f3aaad772b69ca576e82075
  • SHA1 4a6d9df04149f3890e314a02ef3e1e1b0ea31db6
  • SHA512 23474148ce96224020ef62078350e8ffad9cd40b3efcaad65cb9e94ea30566b466f0c88c30e9c016814637044adacbde14bc0843a5085cd6b2c08085a7d1cb28
  • SSDEEP 768:5udApTNctooWUS7C+mo2qtkZo3TMtPImbjb6gX3iioW+cVp6qW++deBDZ0x:5udApTNmU2lU3mPbtXSioW+p+wwd0x
  • TLSH
    T1A9232B003BE8812BF2BE4F78A9F26145857AF6673603D6891CC451DB4723FC69A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2