Extracted

• • Target
    a165bc8b315b0099830489f4e67cbfb63c0c6a0d01437cebad07644392d35a6b
  • Size 45KB
  • SHA256 a165bc8b315b0099830489f4e67cbfb63c0c6a0d01437cebad07644392d35a6b
  • MD5 d4d568125337dfbeffbf23500d03d420
  • SHA1 7a325c390bfe117d4e9bb76896a964ced239ce25
  • SHA512 2dcad1a4bdf6d219dc23e86e9fc5f4c3b2a2fd01da0150f0eb9e05122e842170caf9ee8ac8342a0a7cde713f31b204219b2fb0636c17fc8424f0c7207c239142
  • SSDEEP 768:MuBGJTP0BQ0UWUWHaimo2qVe8V1yp7EcPIpzjb7gX3i26tsVGYNcawegzsnBDZEx:MuBGJTPho2t8V41Ehp3bEXS26tsmaOQE
  • TLSH
    T132231B003BE8822BF2BE4F789DF26145867AF2736603D6491CC451DB5613FC68A42AFD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2