Extracted

• • Target
    a8dae1f6e3b41597f5702eeb99158b1ccf6e293fd01118185be6006cc1045b35
  • Size 45KB
  • SHA256 a8dae1f6e3b41597f5702eeb99158b1ccf6e293fd01118185be6006cc1045b35
  • MD5 1711c8d3844079290013e8121cdedad5
  • SHA1 81e034e1ff5b073a0a8bf526e32935f4fdf14870
  • SHA512 5e1591e8a770d0a51dd6c7593b10f356844f4ee8afe99eba33a9c2c5caa4782a4acdc757ece6c79955e0386708290c58fce3776ad9d123ebf2af2faa57015e1b
  • SSDEEP 768:suJdpTP3tcsWUODmqmo2qVDbqpG3jHuPIhzjbZgXIi3MQo5kgrUmNSMBDZkx:suJdpTPdI2esM3h3b2XF3jo5DrUmNddm
  • TLSH
    T1FB233B003BE9822BF2BE4F74A9F26145467AF6637603D64D1CC452DB5623FC28A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2