Extracted

• • Target
    a2bb625f9e1b248eff5efab7593db10531268c44f9e393a63ca4194f1c9b1d9a
  • Size 45KB
  • SHA256 a2bb625f9e1b248eff5efab7593db10531268c44f9e393a63ca4194f1c9b1d9a
  • MD5 a1f8630ac158c8ca2b405121607d8c66
  • SHA1 fab807e3c8052db270dfcf193940723585eb655c
  • SHA512 a228c202aab3fc893d6390e00239942ea33478bd65da3c5b5d228c7a0f32236053283a82304f10cee9fd17250c4254a6d3e5c121e946237a78ce7ba1a3afecaf
  • SSDEEP 768:cuR0JTPUYkEWUmjWymo2q1wpt0CCMhdjCvS8PIj2jbpgX3ifIze0VlfBer+BDZUx:cuR0JTPjY2p/CChBj6bmXS1EfBkQdUx
  • TLSH
    T182231A0037E9812BF6BE4F78A9F26245867BF5633603D54A1CC451DB1723BC68A436FA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2