Extracted

• • Target
    923754123007733e8da98c25d02905fcbbed6b2833afd37ef135d3fbecfdcd14
  • Size 45KB
  • SHA256 923754123007733e8da98c25d02905fcbbed6b2833afd37ef135d3fbecfdcd14
  • MD5 94bb92c532d2c354f99be7d44f19c58e
  • SHA1 565e214242efe8adac9f75a5d5dedce29a17e270
  • SHA512 827ff28d9cfdac5bdc11fd5225797f2381e097eae9ae73b1d574b57695688c7975169444423b87a1158a4e2b94ef5634fc21c95d95450d3fde47479b3b95f68d
  • SSDEEP 768:0u1YJTHwAUgQWUaT2Wmo2q9liaLzwJAOPIcFzjbvgX2ijxzon+lK/IvYOBDZ8x:0u1YJTHcw2S5U23cF3bYX/jxE+lDwAd+
  • TLSH
    T187230A003BE8822BF2BE4F789CF26145867AF6673602D54E1CC451DB5613FC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2