Extracted

• • Target
    a2361b3ea2ab206bc8ee7d5a873efa7683b01b601ee3f7a3af8829f100d85a8e
  • Size 45KB
  • SHA256 a2361b3ea2ab206bc8ee7d5a873efa7683b01b601ee3f7a3af8829f100d85a8e
  • MD5 da5ff81bf101e5ba12a83d1f72b4468f
  • SHA1 b8c44d7f84408c25ac05ef4b350326a07c106497
  • SHA512 3635b1aa919c08a1ee33ffcefef396f874c273526ce3c2f7a76a75eb6112ee3a2c2c9f6d2d0dbd3a89bd1aca32c7140391b4f6ac9caca6ea1e04cc186c586351
  • SSDEEP 768:8uuSpTg7GBoWUSH6+mo2qYsHO9YjoHPICYzjbqdgX3iTJHX1EMuiRJEMnuhT9qBU:8uuSpTgyf2h6kgCY3bqKXSTl/DJEiATF
  • TLSH
    T157232B003BE8C13BF2BE4F78A9F26145867AF6633A03E5491CC4519B5623FC59A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2