Extracted

• • Target
    98eb92c36aee36de3337cc9d52f29372baf32c3200beae27be8911e6af526f64
  • Size 45KB
  • SHA256 98eb92c36aee36de3337cc9d52f29372baf32c3200beae27be8911e6af526f64
  • MD5 b7de49d2aaf9d14ad2907681a2f155ed
  • SHA1 c1333c30333c3af01519c8df0f075bc4327400b5
  • SHA512 17d82c424104e67fb665e4ad46d120fc690924c9384063c534d0876c8d6fbcd4802f79a3778c8a761a89a1c68907ea25d2fc90fd167016014f010bcf5936ecb7
  • SSDEEP 768:5uSy6pTpwrSWWUE3/WImo2qNdOqwwiSSNjPIjzjb/gX3bG9ofdLblNILmE39OLt6:5uSy6pTpoo28OqL6Kj3bIXLG9oRTIpe6
  • TLSH
    T198232A0037E9822BF2BE5F7898F26145867AF6633603E54D1CC451DB5713BC68A42AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2