Extracted

• • Target
    99c84cfc8249cc88a84026e8a5721472de23be40553a381444dcfcdfa90e7306
  • Size 45KB
  • SHA256 99c84cfc8249cc88a84026e8a5721472de23be40553a381444dcfcdfa90e7306
  • MD5 c22343bc9e0f3df970bcc4cdc8091fb2
  • SHA1 79a02f920ec5910571a934f896295286a5c605c1
  • SHA512 9d9ba18cfea37fc5968bd15b91903c47fbf84f3fa68076dc645a9fad165d6412d13a56d84a2bffa448d9aa7f6f5f962739e7d7ab922e32d7b3299a4776feca02
  • SSDEEP 768:wuDWZTpw7bmaWUg3gSk0mo2qlzfBohEaEPIQMjbrgX3i9+//px5SEczjDB+BDZMx:wuDWZTpMZSB2S4EapQ8bUXS9ih/Dc7BD
  • TLSH
    T11B233B003BE9C22BF1BE4F789DF26145867AF6633603D5492CC442DB5613FC69A426FA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2