Extracted

• • Target
    0ad4783dc0599b7b5029aa2e8c651acd19c20e16f85b362da4a2a6aaf0c515b6
  • Size 45KB
  • SHA256 0ad4783dc0599b7b5029aa2e8c651acd19c20e16f85b362da4a2a6aaf0c515b6
  • MD5 0c1f568278198cd3f5072668a06c2ede
  • SHA1 fcf9384147dccbe6b5150e5670f535962758d8fa
  • SHA512 0eaf8dad55a726ef6fb98a84e98963b184255bf2eb84e6d0e03823961d370440b64b2b9ada1316fdb373f545e505597134fd35fe457d3da2869787c311096c34
  • SSDEEP 768:RuxkJTVmU5EkWUGMKSmo2q11BzwQ/x7PIPajbpgX3i41VutsFzLsTY5RaO3BDZcx:RuxkJTgip2AaFP2bmXSMgt0sTUtxdcx
  • TLSH
    T13C231B003BE8C23AF2BF4F7899F26145467AF1633603D5492CC4529B5A23FC6DA426F9
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2