Extracted

• • Target
    cb98fed76237ea6c9532d8ec1717f7e4f48a56402e2e72355ad8a3e8920a7605
  • Size 45KB
  • SHA256 cb98fed76237ea6c9532d8ec1717f7e4f48a56402e2e72355ad8a3e8920a7605
  • MD5 21fe1593e8354ea44d836dce21b978ec
  • SHA1 1c89e8d045f41633a2e1efe66d89e4632de7b8a9
  • SHA512 20709994cbc183c08cd24bb20938c1db5810e0443b69746864ef29842f47f18589da974fc1442097b702b6145c056e6a3be73b8038ecf462d4d6f9087e70874f
  • SSDEEP 768:MuBGJTP0BQ0UWUWHaimo2qVe8V1RpYEcPIazjbqgX3i585xJXgMw5qegXI/WzLBE:MuBGJTPho2t8VDeEha3b9XSoZgM5I/oS
  • TLSH
    T1DA233B003BE9C22BF2BE4F7899F26145867AF6632603E5491CC451DB5713FC68A42AFD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2