Extracted

• • Target
    96de9ee3569d864da83db3162eb06dfab503cc741dd7edf2aab24a637480d333
  • Size 45KB
  • SHA256 96de9ee3569d864da83db3162eb06dfab503cc741dd7edf2aab24a637480d333
  • MD5 302bd672a04b6087ba025fd714ee638d
  • SHA1 69dc2de4c39f7e0b3f98c008920a09cdc2e6edda
  • SHA512 91729441cc2809a4c947a88c87a533992db4f76c24137104ca7b2325ca4a97622ee835909ac7b292febd5e6fb8103b2eb09c6a6e8e682e3da11a0cd42a8177e3
  • SSDEEP 768:UuKWgSJTwU6NkWUGnaSmo2qAAxJaxMwHuPIvzjbzga3inYN93Z4f1o4XBDZcx:UuKWgSJTwRf2QeN3v3bsaSYN9mf1o4Rs
  • TLSH
    T145232B003BE8812BF2BE5FB868F26145467AF5637603D6492CC451DB5623FC686426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2