Extracted

• • Target
    90b09a0533b286cc7cce93e46d2d7c884692df1e03fcf7c4fecd92bad4b4e81c
  • Size 45KB
  • SHA256 90b09a0533b286cc7cce93e46d2d7c884692df1e03fcf7c4fecd92bad4b4e81c
  • MD5 dd906917091a6b5a9233452cb3e7caec
  • SHA1 31ea06a9eef0e1e67eec9def489df2e7450b4da9
  • SHA512 b2b29c076c6b76851bca433a2a27a148a62e459740cfc22abfeb8823da163d098c9ab62ea986bb880f58b8edc07ab03886428624fbbebd0041d571d41f3e795d
  • SSDEEP 768:UuBGJTP0BQ0UWUWHaimo2qVKcP0pycvHPIGzjb7gX3iSHyGPrCIsdBDZcx:UuBGJTPho2xccMcvgG3bEXSsnCxdcx
  • TLSH
    T147233B003BE9823BF2BE5F78ACF26145867AF2633603D5491CC451DB5613BC69A42AFD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2