Extracted

• • Target
    913a98399bb78f7df6e547add51364057c8dd4e0b7b3d89b12b8962faf3b5184
  • Size 45KB
  • SHA256 913a98399bb78f7df6e547add51364057c8dd4e0b7b3d89b12b8962faf3b5184
  • MD5 a4abd67ea7d4a2134b008699dbc0f6f5
  • SHA1 e03f9c3f80ea7b7024080bd3fb675860b1883240
  • SHA512 873b0e7a97c4df8affc7766b410f889743d16bc74ff2268e9c6eb056837af9a329b24771d161d81da85568b0a0b322917129d603bca89503956634e22318a060
  • SSDEEP 768:kuSOpTPTCFcWUeXa6mo2qAp0e3NEAKViZPIazjb8gd3ifh7WIQRpNkES8W0UZ9FY:kuSOpTPOP2t3exiWa3bTdSJ7WIp3LXD8
  • TLSH
    T179232A003BE9812BF2BE5F78A9F22245867BF2633603D54D1CC451D71613FC69A42AED
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2