Extracted

• • Target
    a342af1dedd9848ae1d308cbf0527e20ce4565ec52a8421c0c12b6b7c3dc27e8
  • Size 45KB
  • SHA256 a342af1dedd9848ae1d308cbf0527e20ce4565ec52a8421c0c12b6b7c3dc27e8
  • MD5 9568d041e6ca722d046605295a990cbe
  • SHA1 8395e2ed3c59f553f960e46d00fac90218f4f208
  • SHA512 6d6e5b41746c5cdb2172fc8961301f58044f6e017768fa75000e6827893f5575212206fcb09ec4964349e1fa914d935c572404a3ccdf6fa170ef09be509efee7
  • SSDEEP 768:cu7m/5THrq+CWUoDuMmo2qFPeeXKGoibbb6tN8/nPI6DzjbEgX3iBQGwqhLR+Z82:cu7e5TH2A27eDqtNKA6D3bLXSevSLUZF
  • TLSH
    T165231B003BE8812BF27F4F7899F26145867AF5633603D54E2CC452D75623FC68A429ED
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2