Extracted

• • Target
    997bbaac9a802a5a9fe05971ee477128285676876572c189f3b6bb6827fe4348
  • Size 45KB
  • SHA256 997bbaac9a802a5a9fe05971ee477128285676876572c189f3b6bb6827fe4348
  • MD5 c3d31938c7d728895fa46d871a5fb294
  • SHA1 a2aed553e13d45b905a10ac960520cc33d4b3654
  • SHA512 921d3272e22109afadcf36def87341030dd07d9e20cd74a1e1af36ccb82b6cc9479be888f1f5eac3a0b294df9a1bb8f4f62ca5090ce84ca18f0bc22704c66518
  • SSDEEP 768:UuKWgSJTwU6NkWUGnaSmo2qAEuwZQaKkPINzjbzgX3iqwogF6Ax8BDZcx:UuKWgSJTwRf2oIN3bsXSqwoW6uadcx
  • TLSH
    T141231A003BE8813BF2BE4FB898F26145867AF6736603D5492CC451DB5623BC6D6426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2