Extracted

• • Target
    97bf063f9bbb09b2cedf0247b370e27088b8a823212c5707bbc2c2bb22190e19
  • Size 45KB
  • SHA256 97bf063f9bbb09b2cedf0247b370e27088b8a823212c5707bbc2c2bb22190e19
  • MD5 24469050f81fbee85e8824e25b86099c
  • SHA1 2a0837c432f11124b519154e33f1da7c17e24947
  • SHA512 6661db43ccc9abc346fe75c33bb24ed48590c088f7e699dccbd282870ba1a45e29b8d4160f2e4a41c7d8c370e12258bf858b1b579a935b5087ec848aa961b285
  • SSDEEP 768:cu7m/5THrq+CWUoDuMmo2qFKBlte40WMOPI0IzjbvgXIi6gojnuQGBDZUx:cu7e5TH2A2d2UM30I3bYXFkj1IdUx
  • TLSH
    T1DD233B003BE8812BF2BE4F78A9F26145867AF6637603D54A2CC451D74A13FC6DA426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2