Extracted

• • Target
    ad520090051910f13b6d66884f49030a3d5add56dadaf88e82179d2e9019ae08
  • Size 45KB
  • SHA256 ad520090051910f13b6d66884f49030a3d5add56dadaf88e82179d2e9019ae08
  • MD5 265b1f2af10f87ab1c5898c19bf83a75
  • SHA1 9f745d46f073e623fa01941bf75048e40feb6206
  • SHA512 41beb060a26beb69cab8e52cd412f615c048ec340ba39e45f0241bcad953fd5db1cb3e8480bb7e4be37955ec8398fad18244f6bbdf730a639a82884a2c8463bd
  • SSDEEP 768:8uUIpT4vvofWWUEXb+Imo2q4zSz8yfzuOPIhzjbdgXGix07kpOvwBDZ0x:8uUIpT4vAj2nSQJ3h3bKXvxiCamd0x
  • TLSH
    T13B23190037E8812BF2BE4F74A9F26145467AF6637603D64E1CC452DB5723FC68A426FA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2