Extracted

• • Target
    96773a48f2441388ed9ed48c25a47a400b6a4109677cfc49fbfe66868f760ebe
  • Size 45KB
  • SHA256 96773a48f2441388ed9ed48c25a47a400b6a4109677cfc49fbfe66868f760ebe
  • MD5 659786bef39258070019fb0f8c6a4480
  • SHA1 61afa51551ec13cce63f75553ee0108143a31d19
  • SHA512 63903a201ba83a0ffa85c699e2859059a14729a15c362e975f4a5346d31882a3dd871cd2c743b6e80510f56299f29f37d90402dfe3e9fd5e4887e315f3c3090e
  • SSDEEP 768:5udApTNctooWUS7C+mo2qt+CHyTtUPI+zjbfkgX3i19B0v30HLEBDZ0x:5udApTNmU2Jnj+3bfrXSR0sHed0x
  • TLSH
    T147232C1037E88127F2BE4F78A9F261458A7AF6633603D54D2CC451DB5623FC68A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2