Extracted

• • Target
    924b91905cf50a73e9abc9807752a3cbbfddef78a3026685347e8a781e0d42f4
  • Size 45KB
  • SHA256 924b91905cf50a73e9abc9807752a3cbbfddef78a3026685347e8a781e0d42f4
  • MD5 9c5f708c8e14f2ff301e2fcb2eccc82b
  • SHA1 780073c4b16978c4887db5d098d58af5101c3008
  • SHA512 e6c0a0ece70a6f75adf371990444d30e7924a5224074c47e5e039e55e92c4c1dc19ea26a2eca6c14d1fa3ca037afc34e045fbeb07e1595880dbaeb16b7db40ef
  • SSDEEP 768:wuZ8pT1Uu4/cWUeT66mo2q1KVbQpaUGcPIZzjblgX3jHPVT1wtenlTc8acBDZMx:wuZ8pT1tc2zVEcUGhZ3biXzdT7lTc8ad
  • TLSH
    T103232B003BE9823BF1BE4F7898F26145867AF2632603D6491CC451DB5723FC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2