Extracted

• • Target
    a2a700162ac2116d1505625ff972c4855f70ee256dd1e16e60b04a643158af36
  • Size 45KB
  • SHA256 a2a700162ac2116d1505625ff972c4855f70ee256dd1e16e60b04a643158af36
  • MD5 e5b263fadf507b3f2237b376c43204de
  • SHA1 adb9d6489cb2ea29165621201cc47aea88cfc612
  • SHA512 15e9d2fbc60b1f4d19bc502145f5732d68649faf776ccecfcecc114ae2038420dc0343f43f7ab5e6ee38e5fe6859e0b03f84486a34e51de2b9e3e452da7c49e1
  • SSDEEP 768:MuBGJTP0BQ0UWUWHaimo2qVyLiE02FjMdjYkkmPIazjb8gX3iBLNeSvccVBDZEx:MuBGJTPho2/L9wQPa3bTXSBLN9tdEx
  • TLSH
    T1E2232A0037E9812BF2BE4F78A9F26145467AF6632603D64D1CC451DB5B13FC68A43AEE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2