Extracted

• • Target
    af872a52274feb19fb93dc60a93d91722801164fea045d28d6320f0b52250368
  • Size 45KB
  • SHA256 af872a52274feb19fb93dc60a93d91722801164fea045d28d6320f0b52250368
  • MD5 7ac125e0e9c32566dc54314a6ef6b1e7
  • SHA1 84493c828fe5fd30d63a3383e0da20b331236de6
  • SHA512 9e261b7c976863aa2c85791078916190542e69c603a4ce61a080e58f06a8475b2f5f8971d05d75ad8402f2251de61d04f3fd7a1ebc9a03787a5fd281f6b7966a
  • SSDEEP 768:EulCJTHESwgWUK3aGmo2q9nDEbHBqjSOPI/XzzjbWgX3iEkoUXEv/BDZsx:EulCJTHl42IyoO3/Xz3bJXS5oNBdsx
  • TLSH
    T1A4230A003BE8C12BF2BE4F78A9F26146467AF6633603D6491CC451DB5613FC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2