Extracted

• • Target
    f84f0b209a7866c8eeb53477ee56c53569adc20456f5bba481788309a5a27f40
  • Size 45KB
  • SHA256 f84f0b209a7866c8eeb53477ee56c53569adc20456f5bba481788309a5a27f40
  • MD5 96bc5bb1ca86c20d0d123b34a80b0d5f
  • SHA1 d090ee5e5ea411b32409ab9f2ae3f08726e057f7
  • SHA512 6ab67f302731c15ffe737552965f27ca107fcd07f033678995ac0733724e982ac0a42bf5057ab71fa03d0a24d5b7717f43e9e71f047a5b6a705bf8d882870474
  • SSDEEP 768:vuogpT78XvEsWUOsRzqmo2qrYBzwQ/x7PIP+jbdgX3iEqUf6t2LBDZkx:vuogpT7I627aFPybKXSQf6todkx
  • TLSH
    T1DA231A003BE9823BF2BE4FB898F26145467AF5632603D94D2CC4519B5623FC6DA426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2