Extracted

• • Target
    aed7d44d9040bc575fa2db13c6ace2da85f5ac97b06c61e9daaa89916d9ba1fd
  • Size 45KB
  • SHA256 aed7d44d9040bc575fa2db13c6ace2da85f5ac97b06c61e9daaa89916d9ba1fd
  • MD5 9a01a9bd9e17483d2772453bff69321b
  • SHA1 63595c691d832c3939ca401940d9abfb26367765
  • SHA512 48ecb11e73b7978c42164ef49dfacc0c86ae4da83275cfd93a200d9b5f1f171b6d6468f0214227de552b5a429b4c57caca9a2d66364b6b657476423796dc60ad
  • SSDEEP 768:UuKWgSJTwU6NkWUGnaSmo2qA45+ZGj9HuPICzjbDgk3i5pnG08d8I/yBDZcx:UuKWgSJTwRf2o2+3C3bckS5pnY8IUdcx
  • TLSH
    T146232B003BE8C12BF2BE4FB498F26145467AF5637602DA4D5CC451DB1623FC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2