Extracted

• • Target
    94c62cfd142acbff5d4bb761edd2f54c7048f9e7f4244a9bf0ff92b0021c1fb2
  • Size 45KB
  • SHA256 94c62cfd142acbff5d4bb761edd2f54c7048f9e7f4244a9bf0ff92b0021c1fb2
  • MD5 e49a99947cc16389121ad7b0190c3143
  • SHA1 c3d69147b4ed0f62ba720ec9ab70edce4b29f761
  • SHA512 d3eba642c1cb33b1e87271eaef9eea99b93f31ce8d71b607f55cfe9d89c327bfb54a84692c05ddd7e6e8c9f9db84d3f0190c19578937b9fb4835b8bcf906d84c
  • SSDEEP 768:5uSy6pTpwrSWWUE3/WImo2qNC9YqPq3hOPIezjbQgX3iGpfN3M2HHBDZ0x:5uSy6pTpoo2/aqq3e3bXXSuF3M2Bd0x
  • TLSH
    T1BB232A003BE9822BF2BE5F789CF26105467AF1633603D6491CC4529B5713FC69A52AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2