Extracted

• • Target
    f90d949b5c9b3ec31874e10e6bf9a3c2b9c96c1410962cea9754d4b24f5f168e
  • Size 45KB
  • SHA256 f90d949b5c9b3ec31874e10e6bf9a3c2b9c96c1410962cea9754d4b24f5f168e
  • MD5 4cd358aad3386cb1f376f9236ccb3db5
  • SHA1 997139c50c015eb59ed675b48a4d7f43de93d401
  • SHA512 9559cef377beeff137767b839e14e44b83685aee9945aae8866dc0d3a6c6c35a9c0cec2f1a8eb9f5e6158b54d5c3950d25a20c50baa2a4a35282ebab12cf0792
  • SSDEEP 768:MuBGJTP0BQ0UWUWHaimo2qVufPLyTObvtkjZPIizjbegXBiHZC/Kulx8jPBDZEx:MuBGJTPho2Hf2TyyjWi3bhXQHZCiuO5E
  • TLSH
    T188232A0037E9812BF2BE4F78A8F26145867AF6736603E54A1CC451DB5613FC6CA42AFD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2