Extracted

• • Target
    ad139d696a37df3621adc297c11ec0c8d39893b39022f95a0806fcd67738833c
  • Size 45KB
  • SHA256 ad139d696a37df3621adc297c11ec0c8d39893b39022f95a0806fcd67738833c
  • MD5 3096c6be6ff196484a61f6dd92aa7f52
  • SHA1 e34b131e84c4f17a4691c853eb4c33bdd8c794de
  • SHA512 0aae317eda1dd6411eba50f7c71600989646a996f9fb4fbb0f5eac78f37ef9d0f9f654604f100b39bfa802c706977dc03b90fda00651eec2119e41346dd21f76
  • SSDEEP 768:0uPrpT/LGKeWUszuAmo2q9zwD/y/aqPIRzjb6gX3icvpHoMsUE2QeBDZ8x:0uPrpT/qY2QkhR3btXS0pHoMsB2hd8x
  • TLSH
    T140232A0037E9C12BF2BE5F789DF26105467AF6633A03DA8D1C84119A5613FC68A526FA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2