Extracted

• • Target
    91fa22347c1a17310aeb069edce9e4d2b77b08bf2d3b5859acdeaf3077214a8a
  • Size 45KB
  • SHA256 91fa22347c1a17310aeb069edce9e4d2b77b08bf2d3b5859acdeaf3077214a8a
  • MD5 d76babe730a253c25a56595910e902df
  • SHA1 5cdb7a94dce1f6702e92cabde24c4ee9a7dac3a9
  • SHA512 833f2d3e5c9d29958a0935fa81dea0c00e750089cf3ae8cb2701268f7446aa97b3f55a0e65e00e3a5121fde5cff598fc4e7dfdc8c95ac37715c3a7df36745cde
  • SSDEEP 768:cu7m/5THrq+CWUoDuMmo2qF4ZTohEaSPI9zjbCgX3inZEJt8i6D+NKyBDZUx:cu7e5TH2A214Ea793blXSnaJ2RD0dUx
  • TLSH
    T118233B003BE8822BF2BE4F789DF21145867AF5637603D55E1CC442DB5713BC69A42AFA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2