Extracted

• • Target
    0ea27556494850deeb82b76e7be6a34e1e2adc119069553450c112de79d46903
  • Size 45KB
  • SHA256 0ea27556494850deeb82b76e7be6a34e1e2adc119069553450c112de79d46903
  • MD5 51ca1a0a61870c1feadb6a1fa99d0002
  • SHA1 c9dc0bff6a07bf6eb0e81dc0e6a0d7ff6e209dd5
  • SHA512 aad79ded6d71fb4390bab48b1bd9cfad7932090a82d0c9e8731eaee1ecd732914e50f737aeafe3d3bc461b33523c0090d9202c2d8fcc6ce2c985d5b60e2f8299
  • SSDEEP 768:kuSOpTPTCFcWUeXa6mo2qAaL5P02FUFdxYkk8PIRzjbTgX3i7OpBamZG3BDZMx:kuSOpTPOP2KLDmWBR3bMXS7OpBamQdMx
  • TLSH
    T169231A0037E9812BF2BE4F74A9F26145867AF5732603D6491C8452CB5B23FC69A036EE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2