Extracted

• • Target
    090adc9a035e1c460c878a06e237a96f5e0e7bd4ae0316be7301e2fc719d8ae0
  • Size 45KB
  • SHA256 090adc9a035e1c460c878a06e237a96f5e0e7bd4ae0316be7301e2fc719d8ae0
  • MD5 5750bf953300f8c37d33d273f0c69222
  • SHA1 8ebc01fc910575d2ef84140b4a6d5ba90a3a2211
  • SHA512 840efbe5c7b9d93449b60df019dd98c271ee8d2f0d4f8173aca5a7c82bf3c3a56c3af0e7bb67c258c3064f70e5115762097d21182a69f7b568180b8713107366
  • SSDEEP 768:8uUIpT4vvofWWUEXb+Imo2q4gozHyvCKPIiNjb+gX3i0diMSS50lphnV/cOBDZ0x:8uUIpT4vAj25L5iFbBXS0dZS0cVEAd0x
  • TLSH
    T1F0232A0037E8C22BF2BE5F749DF26145467AF6633A03D5891CC4129B5623FC58A52AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2