Extracted

• • Target
    91eea17b03eebfca365719ede60999898a7b4ac854c5fd1166d0b21c943682bd
  • Size 45KB
  • SHA256 91eea17b03eebfca365719ede60999898a7b4ac854c5fd1166d0b21c943682bd
  • MD5 8b45732db211fad9ad4a51d356f5d85f
  • SHA1 2217156c9f8cd1c983311c9ea590809dff58ef08
  • SHA512 5e85d6fe01530338ead7127bc0297b8a12044345ec05df405c371170fda4d802fbdf77eb7f9a1732b415a8a44421145d6a0a9229023b7ee8280ec27713a716be
  • SSDEEP 768:cu6RaepTPYzbs8WU+Xaamo2q13oCa/ld3APIXzjbcgX3IqV94HrcS2y7PBDZUx:cu6YepTPso2OE/T3lX3bzX4IuHAS2A50
  • TLSH
    T1DA23190037E8823BF2BE4FB899F26145867AF2637603D6491CC451DB5723FC69A426F9
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2