Extracted

• • Target
    963145092c995c49149d2c734f280bf2741a7bab9f4ad21da72e94c79ac61349
  • Size 45KB
  • SHA256 963145092c995c49149d2c734f280bf2741a7bab9f4ad21da72e94c79ac61349
  • MD5 9200155f53113d05542b08bf7a6f98fe
  • SHA1 95e84d917c2d50e4b029f4ddd575c60aee991354
  • SHA512 6c92b45f34832473a848706d66f767fc1339cb2fb8de43510b150692e341efdfca90ab59b6120319c6f5049d2b4dc18ab7f675fe468b2f4fe6dcaae7bc2c273a
  • SSDEEP 768:cu7m/5THrq+CWUoDuMmo2qFFeeXKSocbbbQtN8/nPI6kzjbggX3ixoIHwrJOBtek:cu7e5TH2A2deH2tNKA6k3bHXSXQO7SdW
  • TLSH
    T156232A003BD8C12BF2BE4F7899F262458A7AF6633603D94A1CC451DB4613FC59A42AFD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2