Extracted

• • Target
    93f15b2a81a2ab218d5e87ba466ce55fab7d20d49c040b9bab6471ffd510cbbf
  • Size 45KB
  • SHA256 93f15b2a81a2ab218d5e87ba466ce55fab7d20d49c040b9bab6471ffd510cbbf
  • MD5 99b34e0b01c0bcb6c053122280511ac0
  • SHA1 432bd75c9c2ffcbb0fe194572b5af9886d2dcd1e
  • SHA512 7cb82c1c9d32e2f036dc743b3f59d932cc0f75d6ddc20910c6e29c984ab21377dbd51f2e7778127cc625f9421fc3d16a13e0056f130a631032648328db787532
  • SSDEEP 768:cuqb5TrIGuCWUoKXMmo2qQmAuXueM+D58vnPIM9zjbCgX3MYDC6SlTGBDZUx:cuqb5TrhG2BuznD5iAM93blX8F6StIdW
  • TLSH
    T179232A003BE8812BF2BF4F7899F26245867AF2732603D54A1CC451DB5723FC69A526ED
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2