Extracted

• • Target
    a271c5f26c10d538a6e458b77008d7434ada26a52aad8ceea275124cc4750be9
  • Size 45KB
  • SHA256 a271c5f26c10d538a6e458b77008d7434ada26a52aad8ceea275124cc4750be9
  • MD5 1e440f860d4d7878ecfed87217b5a1dd
  • SHA1 2fde0b532a6adff86e72611b2243d69d2914dc97
  • SHA512 0b6364dd6b35529052d89056fdbc9b23cfcb1c8666b9de4840a18a0a59fdb2ffccdb8d5c25ca463f9a285e58f35fb9f7af7dcbd101dcd6be4a45986dbcc3db55
  • SSDEEP 768:0u1YJTHwAUgQWUaT2Wmo2q9IDEbHBOjTOPI/TzjbxgX3ic0kzvCtg22oCnBDZ8x:0u1YJTHcw2HyYf3/T3b+XScBv8aoUd8x
  • TLSH
    T187230A003BE8C12BF27E4F789CF26145867AF6637A02D54A1CC451D75623FC69A42AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2