Extracted

• • Target
    d91091edfe837fb8a6953be08a77ed7e5660f3513fcbfe26c168b43e2423950c
  • Size 45KB
  • SHA256 d91091edfe837fb8a6953be08a77ed7e5660f3513fcbfe26c168b43e2423950c
  • MD5 64b8eff155cf34d5f1b40820a0774e4e
  • SHA1 4d097c394aabe9b80d8440bb9023b5043e9614ad
  • SHA512 d28decfadd5d19fed3c6ee4c3026b466f159c71d709d88d5fc4c3e927c46fb23d2ff1e0012e970779a8e4b6c7b7ae07502d25eff077c9c52563bafc29a5907bb
  • SSDEEP 768:RuxkJTVmU5EkWUGMKSmo2q1WT9Qpm9PIjzjbdgX3iImrfKpgWYpBDZcx:RuxkJTgip2BQj3bKXSIWipTWdcx
  • TLSH
    T1B5231B003BE88237F2BE4F78ADF26145467AF1636603D54D2CC452DB5A23FC69A426F9
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2