Extracted

• • Target
    95eeb243e28e3c1eee3555ef6a6b978772610dc0cf5620764992f4d848dca514
  • Size 45KB
  • SHA256 95eeb243e28e3c1eee3555ef6a6b978772610dc0cf5620764992f4d848dca514
  • MD5 bdafc4ed899891bbc2a1242f0ac58b6d
  • SHA1 b50f53ed6ad3ac6252a6b10d60297c1f7fb1d5ff
  • SHA512 c8c39ac5e31d0ff7031a7f1cb929abbee77a3178bfeb43761eb89cdaeec1a4823c109deea4a66fdfaac0aedd6a806ff335a807577a9afd7c79f0bd9f0b546600
  • SSDEEP 768:suJdpTP3tcsWUODmqmo2qV2maPcl83APITpzjbagX3ixovTHi28OtJBDZkx:suJdpTPdI2HfcS3lTp3bNXS8228O9dkx
  • TLSH
    T10D232A003BEC812BF2BE4F78A8F26145467AF6637603D64D1CC4519B5A23FC69A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2