Extracted

• • Target
    ba9ae2fb1bbdcb5ed8b429485216a2ce3c01c477bebe7bee801a3a6bc7e01201
  • Size 45KB
  • SHA256 ba9ae2fb1bbdcb5ed8b429485216a2ce3c01c477bebe7bee801a3a6bc7e01201
  • MD5 a00ebfdd458ca46f915a8f8681b213f1
  • SHA1 f86954ab6e474a44d764df613b7bbb279a20f5ff
  • SHA512 392f324bc5a40d4bd7cb637f0d8e7ee000f9d38a9eeb7a689380581e3e7d0898349503bec5b753b3f115751b5fa65dd53edff491e6126687f82ee154d14846e6
  • SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFEfBohEaEPIQ7jbMgX3iXP3XtktTRmKGCmgqIcW8LBE:MuLAZTnbg2Z4EapQvbDXSXP3XtCsCD7d
  • TLSH
    T1F4232A003BE8822BF2BE4F78ACF26245857AF5B36603D54A1CC411D75613FC69A426FA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2