Extracted

• • Target
    91923119beaf72cdbc35913f0b7bed25c20291afd490b305b3fdee1fa6a60b01
  • Size 45KB
  • SHA256 91923119beaf72cdbc35913f0b7bed25c20291afd490b305b3fdee1fa6a60b01
  • MD5 d32a2c530c7a5b7565a85b9ba6d68d30
  • SHA1 22ef09fd75a0801bb71886cf120876b0ea68415f
  • SHA512 75c2d44042ec81dcc212d758e531b96d4dfd323958b9d070580d88395b0f2d871df85258359b55873e4f9e32df0a961826ebf4788376089d6775b5a84e0ecad9
  • SSDEEP 768:cu7m/5THrq+CWUoDuMmo2qFPAuXueM+D58vnPIM9zjbegX3wWz5aZCGG1aw2BDZW:cu7e5TH2A2RuznD5iAM93bhXAoQZCGGt
  • TLSH
    T126231A003BE9812BF27F4F7899F26145867AF2732603D94A1CC4529B5613BC6CA52AFD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2