Extracted

• • Target
    96eaae6eb2b870c074f60cb924fca1af010e58d9e9185ee19a468089651af737
  • Size 45KB
  • SHA256 96eaae6eb2b870c074f60cb924fca1af010e58d9e9185ee19a468089651af737
  • MD5 bad904a577ad50b713c2c3d7a13d8773
  • SHA1 915eb111371ef51bfb0d38d965c0f941b166667d
  • SHA512 200bacb179ebbb3fdfb3385f9907082e399b1ef71b6883547d5842f2a626278cfb7971a5623c16915de70d9639cd1ff86c6c1ec16698626a1a352bc6f7f5e33e
  • SSDEEP 768:cu7m/5THrq+CWUoDuMmo2qFFeeXKSocbbbQtN8/nPI6kzjbCgX3izNJf3JcA3sB0:cu7e5TH2A2deH2tNKA6k3blXSzNJPJcg
  • TLSH
    T123232B103BE8C22BF27E4F7899F26245867AE6633603D54E1CC4519B4713FC69A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2