Extracted

• • Target
    aba5a1dc8f9c61604984b12fef0d9ee01710cff6589d0ea02881638873591a9b
  • Size 45KB
  • SHA256 aba5a1dc8f9c61604984b12fef0d9ee01710cff6589d0ea02881638873591a9b
  • MD5 1053e44c204a577496ff05893bc586ab
  • SHA1 b173bf1ee0571637b524a7ace23abae69d62f68e
  • SHA512 4c21baf02d780af805aa73c359eb1455e96cb9aae0ab9c7b4807831e39d2c3d51e5f7dab31b84de885e0c0ad7e56ea6f332c3934a796df0416b3de0dcfbd941d
  • SSDEEP 768:EulCJTHESwgWUK3aGmo2q9N/zBNMwpGPIMuzjbmgX3Avr7x8I0TrhWIYBDZsx:EulCJTHl42y1GYvMu3b5XQvH38bedsx
  • TLSH
    T150231B0037E9C22BF2BE4F78A8F26145867AF6633603D68D1CC451D75613FC69A426EE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2