Extracted

• • Target
    95723318215a4f75a60de12c095a0cae8eda6baba48c225747b01bce6b9b1df6
  • Size 45KB
  • SHA256 95723318215a4f75a60de12c095a0cae8eda6baba48c225747b01bce6b9b1df6
  • MD5 e05d567d98c3997468067b8829127f07
  • SHA1 cd47b78e8de67ab740b33ef0556d9de131142dbd
  • SHA512 3e9fbf70b23c753eec38285299f0a491f6062b2103dc43b2e5102ff35f7bbd0af8cb59064f1565edd4e3f932270618dcdfd7e60d36e56a4bd1fd1b9f2f80ce8c
  • SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qF2seXusMkFX8vnPIMvzjbagX3oa011WqsXBDZEx:MuLAZTnbg2weB1FXiAMv3bNXYa0HWqsW
  • TLSH
    T159233B103BE8812BF2BF4B7899F26105867AF6633603DA4E1CC4519B4713FC68A526ED
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2