Extracted

• • Target
    a29204d2671315e686babe9aac8a5f2fec5605c24b023de0bcf4273cd3ef3266
  • Size 45KB
  • SHA256 a29204d2671315e686babe9aac8a5f2fec5605c24b023de0bcf4273cd3ef3266
  • MD5 17a64597b2a501cd400035637d48f377
  • SHA1 7faae9ae969453df5b8ee4a9d0c141f2b8d8aa33
  • SHA512 f7cf12817c3878fceebbfd341519ea60a15b1d721acad2f4091d13998ab9fd6a2aa5464b0c7601f52938d619442d3428fa80ab1185b0d3686747535bcb04e197
  • SSDEEP 768:EufspTfzcR6uWUcb+wmo2q9EIrnyfaaPIrzjb4gX3iNu9nQTHJ7pjihgLBDZsx:EufspTf2g2f8xr3bvXSBTp7pehgddsx
  • TLSH
    T117231B003BE9C12BF2BE5B7899F26145467AF6633A03D6491CC411DB5613FC68A42AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2