Extracted

• • Target
    ae4bd0faf790842af95bae7a46c0c3cb712b50659b342f76890bea4f5554eb8a
  • Size 45KB
  • SHA256 ae4bd0faf790842af95bae7a46c0c3cb712b50659b342f76890bea4f5554eb8a
  • MD5 d594cfe0a5673b2bc325ca942bc7ef28
  • SHA1 429b97739cb7757d717b3d82d27986b129c19ea9
  • SHA512 0bd34e31b2e6ec4fbc321dbe6a89ac3c5019502197690b0970d5f2035254dac35d3462fe1ba20c9be9afd12069411b3a4876b80315169d6e065f2d4b8fd68c4f
  • SSDEEP 768:kuSOpTPTCFcWUeXa6mo2qAhpt0CCMhdjCvS8PIjPjbagX3iI0PaCjR7B9fBDZMx:kuSOpTPOP2x/CChBj7bNXSItCF7B9pdO
  • TLSH
    T1B3231A003BE8C127F2BE4F7459F26241867AF6632603D55A1CC451DB5723BC69A42AEE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2