Extracted

• • Target
    92f9b608391651f98393677326f3d4131587527268cdcb61057e7a64a4378267
  • Size 45KB
  • SHA256 92f9b608391651f98393677326f3d4131587527268cdcb61057e7a64a4378267
  • MD5 86b6680d81432fffbefbd1f42d13eddc
  • SHA1 fd690953ea54d7a04e6f0c98a9661606415d7b70
  • SHA512 086c48c83c4d2c2b579ff9e98fbb76d946d9a3be85f0b67247a8e7533c14797aac101e4a6f52c0d6723ea8cd4341167adc84f5682ee9bb6714515b4553d131b9
  • SSDEEP 768:8uuSpTg7GBoWUSH6+mo2qYlCSwTMSPI53jbOgX3i7LKC3AksBDZ0x:8uuSpTgyf2dgG5TbxXS7eC+d0x
  • TLSH
    T159232B0037E8812BF2BE4F74A8F26245867AF5672603D58A1CC4519B5713FC69A42AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2