Extracted

• • Target
    af697ee202cd86ef958abf14488476c8f33ea392acc87fbc5d83f1fafd7bd63f
  • Size 45KB
  • SHA256 af697ee202cd86ef958abf14488476c8f33ea392acc87fbc5d83f1fafd7bd63f
  • MD5 a43cd280202643f4faef189554906014
  • SHA1 aad8cdf4504346f49ec818736a9438003ea21179
  • SHA512 6238d3527554c21e0b73212360ad912cf0ae0aaeca7cb8e98cec35c9c668ee8bed27ff5892efe46797ac69f64f2b89d34c3d5bd94e65c1d15d5f58d4e1186f2b
  • SSDEEP 768:0uAVhJTDEQAQWUaDyzWmo2q7sZoQTMtPI4Yjb1gX3iOK/ZTj+jnBDZ8x:0ushJTDXgH2vL34QbSXSOKpkBd8x
  • TLSH
    T1ED232B0037E8812BF2BE4F78A9F26145867AF5632603D54E2CC451DB5723FC69A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2