Extracted

• • Target
    aeedf0b1d0533a8880dddd9b807cf4ad646cd0c1de2649420ee50553452b68aa
  • Size 45KB
  • SHA256 aeedf0b1d0533a8880dddd9b807cf4ad646cd0c1de2649420ee50553452b68aa
  • MD5 cde018ca1a92a12ce0104d1bec45a61d
  • SHA1 449cab92f7a88e13dae4d629e0d4b61a535c2666
  • SHA512 1c9eb96dd7ee02445c737d2de56e1f987554c5508f885f59994f5645811d612c821c91dbf4400648b0247a846626a0457d873684facf58ef288eafc6e253e607
  • SSDEEP 768:8uuSpTg7GBoWUSH6+mo2qYlCSwTMSPI5ujbjgX3ivstM5RvQ/Q83vUl3BDZ0x:8uuSpTgyf2dgG5Cb8XSvB5O5vUPd0x
  • TLSH
    T188231A0037E8812BF2BE4B78A9F25145867AF5677603E58E2CC441DB5723BC686427FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2