Extracted

• • Target
    95781d0a3a2415d6b8268306ae55a927e737008c1d2da2970531b7d3edda2e65
  • Size 45KB
  • SHA256 95781d0a3a2415d6b8268306ae55a927e737008c1d2da2970531b7d3edda2e65
  • MD5 a6ea4aeac2ac59465fff0bfa980bd570
  • SHA1 164edc9e371f770df282beb20bfb6cdc064d0dcf
  • SHA512 1ee423bba57f0a565908f5e05fa2386afbf91b2c286001f0a45c17c1d14a93c3b1f01e00b20d9ae8dd0757ec076ab643695119c03c75fcdbac413742de99dfa6
  • SSDEEP 768:8uUIpT4vvofWWUEXb+Imo2q4UwD/y/aqPI/zjbEgX3ir6LVWZs+sCVOBDZ0x:8uUIpT4vAj2wkh/3bLXSr0WS+Cd0x
  • TLSH
    T1DE232B003BE8C12BF2BF5F789DF26145867AF6633A03D5891CC4119B5613BC68A526FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2