Extracted

• • Target
    aee365fabedaf4b67777f6e03d3573cbcf5a8497bae4e762ccaf1083a991244b
  • Size 45KB
  • SHA256 aee365fabedaf4b67777f6e03d3573cbcf5a8497bae4e762ccaf1083a991244b
  • MD5 a8088c808f01ae514d936d6f0efc6e7e
  • SHA1 c3555f1901df4a7b7eb7bf94e611cb934f886772
  • SHA512 39d71fe6297642cc17fa15eee46ba9d3bba3a9f4e315e29ab79762982b07a51784bf9f5e0bc033ec612a37e1eb68e812d449b9a88adeeb4d22c376fe4be34b0b
  • SSDEEP 768:0uPrpT/LGKeWUszuAmo2q9zzjHy/aKPIbpjb6gX3i3P85pLygBDZ8x:0uPrpT/qY2QnhbJbtXSkrd8x
  • TLSH
    T106231A003BE8812BF2BF5B789DF26145867AF5632603D58D1CC451DB5623FC68A42AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2