Extracted

• • Target
    9431024375225c21476f7fdc5a757b76e4660fa8e67529c065a52692f807f08a
  • Size 45KB
  • SHA256 9431024375225c21476f7fdc5a757b76e4660fa8e67529c065a52692f807f08a
  • MD5 8e4d51bb3393f0023ee892fa01ad192f
  • SHA1 6ff08eac71d50c7312af8ed3c78557b118568f84
  • SHA512 79c29659a815a820252467c69208f26ed8eacd5c6fcf8bc8162ed442f4589b9e74b7370552df936ff7fabe9567bec6c8b10da8b9bc19197004f3cba575cc3427
  • SSDEEP 768:RuxkJTVmU5EkWUGMKSmo2q1umaPclm3API7zjbSgX3iyAYxdwQzvq83fDIBDZcx:RuxkJTgip2PfcE3l73bVXSyAYxd12dcx
  • TLSH
    T122231B003BE9813BF2BE4F7899F26145467AF2636603D64E1CC452DB4723BC69A426F9
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2