Extracted

• • Target
    092d268080289df8d5f6eff02eddbb0b4c83fe05ebe68cc1ab06191d29f1db58
  • Size 45KB
  • SHA256 092d268080289df8d5f6eff02eddbb0b4c83fe05ebe68cc1ab06191d29f1db58
  • MD5 d7694d5337b70522a60c37728c3aefc2
  • SHA1 89d68cc328e340ed2d4868e00a570fbfc4736fa1
  • SHA512 7ebf73a56244268668ae29ec4edb9d647867734b6f6a968c10407af9fe7a41e63f0bdc6e97ddfa06645d0a9922101984ddb28cb21e3d7d6c1a9f992a9df33fd7
  • SSDEEP 768:kuSOpTPTCFcWUeXa6mo2qA70ewUkA1MiZPI7zjbRgE3iFyO8Vsl1zLMYBDZMx:kuSOpTPOP2/wvDiW73beESJH/dMx
  • TLSH
    T14A232B003BE9812BF2BE4F7859F26245867AF6633603D5491CC451DB4A13FC69A43AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2