Extracted

• • Target
    96ddbc1582a6b2af9ca73fccd2efcaea9c56ff7f624a150a6cf2f14cb9916741
  • Size 45KB
  • SHA256 96ddbc1582a6b2af9ca73fccd2efcaea9c56ff7f624a150a6cf2f14cb9916741
  • MD5 685f4572f521a84e19cd2f41453ef6b4
  • SHA1 ab02ff165a706c85ae947e4dff57bac0d3b6ba26
  • SHA512 53f310f6b6b572a6b04e27ba2be7b7f17b94e929e21b78f039575a8b0ade114fe64241b6fb289da0b47107832c5b13732b30b413ec2a9240744e9f4584174daf
  • SSDEEP 768:RuxkJTVmU5EkWUGMKSmo2q1umaPclm3API7zjbRgX3i5Wjpf75sjlESBDZcx:RuxkJTgip2PfcE3l73beXS5kxCjBdcx
  • TLSH
    T1992329003BE9813BF2BE4F78A9F25145867AF6637603D64A1CC441DB1623FC69A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2