Extracted

• • Target
    93b6db2af79472ba69124fa224a81eb95dc172662f0d49fa2761a2d39cda962f
  • Size 45KB
  • SHA256 93b6db2af79472ba69124fa224a81eb95dc172662f0d49fa2761a2d39cda962f
  • MD5 c99374fd3bd3281fac32520647e5bde4
  • SHA1 db596226d5fdd71ba9dfeab3c451067312d7770a
  • SHA512 50512d1b6730fffe94f07befa53003c05f975495bb24e328649c8540a6ced2551d47b16f0fa37d506622629db33ab2982afb1c7862f5b31fd5b71ca6cf306c12
  • SSDEEP 768:cu6RaepTPYzbs8WU+Xaamo2q17b3/GYjHuPInzjbjgX4iJvptTGFrgkhzBDZUx:cu6YepTPso22L/3n3b8XVZptCFrgkhV0
  • TLSH
    T1B4232B003BE9822BF2BE4FB498F26145867AF6636603D5491CC441DB5A23FC6DA426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2