Extracted

• • Target
    afc834d1ccd8637d4fd4504ade58468f1369ecccaece98e62bbbf39fcf68019f
  • Size 45KB
  • SHA256 afc834d1ccd8637d4fd4504ade58468f1369ecccaece98e62bbbf39fcf68019f
  • MD5 0a84ac1b213cb10445abf2e7f98bc29a
  • SHA1 dbf65768f1c98ffdd0895542243fedc4cf1a8a32
  • SHA512 f463d8fb618e657207937361e46c0f5ee61cc95760b495e2e8e4dd69686c09b7d9c7e8e9cf7217de6a17baad0805af3158de2e76d631b46eb2dfc46f75376714
  • SSDEEP 768:0uPrpT/LGKeWUszuAmo2q9zzjHynaKPIsVjbugX3ioxjReJULWOBeShBDZ8x:0uPrpT/qY2QnZs9bRXSoxjWUL5Beed8x
  • TLSH
    T1A3231A003BE9C12BF2BE4F789DF26145867AF6632A03D54E1CC411DB5613BC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2