Extracted

• • Target
    97cefeacb8751997a418733f2f2791b68c3ba6c6452a1d6b7719ac3ec74d3412
  • Size 45KB
  • SHA256 97cefeacb8751997a418733f2f2791b68c3ba6c6452a1d6b7719ac3ec74d3412
  • MD5 424da06a9e11534d930fab74b6c4c76a
  • SHA1 46da404073542e17ea8ff212a74a03b4c3a09277
  • SHA512 68f930d5795adc44f3bb64fec97d7243a784b4a51417d177760a59b9f39301b116b6fbf6db0645c72f4e5f5a537899a4031daf1af81bed4984266bffa5296830
  • SSDEEP 768:cuqb5TrIGuCWUoKXMmo2qQUhk6K7OOPIzzjbogj3iGeviH2GzVKyFBDZUx:cuqb5TrhG2g6VO3z3b/jSGFHHhKyLdUx
  • TLSH
    T141232A003BE8812BF2BE5FB89DF26145467AF5B32603D58D1CC4529B4613FC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2