Extracted

• • Target
    0a00275cbe0a32ef6206260a1a2a9311c97e8214ede589febc1b311ec86b185e
  • Size 45KB
  • SHA256 0a00275cbe0a32ef6206260a1a2a9311c97e8214ede589febc1b311ec86b185e
  • MD5 3becaa022660c27591fa9137e032a7dc
  • SHA1 c02c579427375c539bcc326d12df5eee0070b197
  • SHA512 dd9d3032ccbd8561b46fb1ebf0d6a0852911c21ca200f8bef0abe7dfaecdf03f61f8fe9a52901cae4929f4bf99b6b4b0df070263b4c5d3297e6fc7e2436643c7
  • SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qF33FoDEaOPIYzjbEgX3iNqO+zG2RWm7ZxlBDZEx:MuLAZTnbg2CKEa3Y3bLXSslbZRdEx
  • TLSH
    T1E22319003BE8812BF2BE4FB8A8F26146467EF5736603D6491CC441DB5713FC69A52AF9
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2