Extracted

• • Target
    1a0a05397a33da228c2b40b8bce6ed76b7c1dde7250204f837c4f6dbd8c0d588
  • Size 45KB
  • SHA256 1a0a05397a33da228c2b40b8bce6ed76b7c1dde7250204f837c4f6dbd8c0d588
  • MD5 af3a89a8e030b44662abecba3e487332
  • SHA1 1b1baec717b1be68812edf36cf2137771eaa9ab2
  • SHA512 89cdcd9dbf02e19392ba898daf8463a42f1807ab06facb48b8f54c3adc1c5196f16fa561d35c9943e7263390c6d736fc37b108bd0c43a816d075ee3dc87fd2be
  • SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFB3XoPEayPI2zjbkgX3ia5o8KZ4Ph2RXzCBDZEx:MuLAZTnbg2umEab23brXSay8KZ4mXz8E
  • TLSH
    T1E4232B003BE9C12BF2BE4F7899F26245867AF6B36603D5491CC401DB5613FC69642AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2