Extracted

• • Target
    a91998343526184c666371b5be3a6173701f4e31006f4d713ca39c7e1927783f
  • Size 45KB
  • SHA256 a91998343526184c666371b5be3a6173701f4e31006f4d713ca39c7e1927783f
  • MD5 4587701c2a129cec27d819d8f8c79e8a
  • SHA1 39c2a97214677c140c778d422ee6c72ad1355709
  • SHA512 89b52b8401731b443a97489e4bf6b6ab83e30fb39658ecd56e60937f40e20a07b9e3e0cf30a5351f9aea170acab75d88b6a7eda72df97b08294c1b4885a22fe7
  • SSDEEP 768:kuSOpTPTCFcWUeXa6mo2qAW0ewtDc30oiZPI/zjbQgX3itDnVWzI8SMBDZMx:kuSOpTPOP24wR2iW/3bXXSmJSKdMx
  • TLSH
    T107232A0037E9822BF2BE4F7868F26241467AF6636603D5491CC451DB1B23FC69A43AFD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2