Extracted

• • Target
    aeebab79bcdbaddd8a3103249a9de005d8db09fa02af58689cb6e46c3cbe3cc6
  • Size 45KB
  • SHA256 aeebab79bcdbaddd8a3103249a9de005d8db09fa02af58689cb6e46c3cbe3cc6
  • MD5 c124cde366229cce5fee2242032f6b77
  • SHA1 defbe448dfdd0844841cd6267a54f21665adbd5a
  • SHA512 06a47325b7868f17557c3acd193646cfa8376276d2289663de2c610f75ba3fa1a08ddf5dff4f02ddc2f73bcb49022bcc65b444b2fec8159787ada9a070484c39
  • SSDEEP 768:8uUIpT4vvofWWUEXb+Imo2q4UITnyHaaPIUzjb4gX3iGrz5kx0N21x1B9X9hOBD:8uUIpT4vAj2wE5U3bvXSoz5kxK2H9X9h
  • TLSH
    T12F2319003BE9C12BF2BE4F789DF25145867AB5632A03D58D1CC4129B5713FC68A52AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2