Extracted

• • Target
    90079e8c468f6ad0d233aebae3afff9402023180f187334ce4aaa3c85ade0c34
  • Size 45KB
  • SHA256 90079e8c468f6ad0d233aebae3afff9402023180f187334ce4aaa3c85ade0c34
  • MD5 0ae3a3deca1917f1a3df840358e4da30
  • SHA1 1daf2e82dbe4413a8a261d22f634e1b66acf6b8d
  • SHA512 9aefbf7ca59286d2e130025c1c11223db1d21eb9a20225649d95a5d9f53d932560c526ef507bdd47d76acb01cb99d56503bf6c484c71ca9fe1f3ef8373be8012
  • SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFc0KFUKoobbbQvhy/nPIA/zjbAgX3imkhDWXVBDZEx:MuLAZTnbg2OK/avh4AA/3bnXSm6CX7dG
  • TLSH
    T183232C003BE8C12BF2BE4FB8A9F26245867AF6632603D55A1CC451D74723FC696426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2