Extracted

• • Target
    ae58f125d2832e1498c4e41007601862040d1bd62f91e6039fc6e8f4ae47c558
  • Size 45KB
  • SHA256 ae58f125d2832e1498c4e41007601862040d1bd62f91e6039fc6e8f4ae47c558
  • MD5 3073001f4a9c0aac92fd0bf4786c8177
  • SHA1 0dc5baea90570592f6f8b3fd57f9dc44fd247d40
  • SHA512 9e2b6f09e3d49fe5b2091cc727821be19e2234cd10e9493837e598c333f169b09706660c7d089442c2e6378e63c3b7ad0e7e0aee4ad4823aab716d1d5fc1b7ef
  • SSDEEP 768:wuDWZTpw7bmaWUg3gSk0mo2qlplsNoPEaMPIckjbhgX3iPU21452mbuBDZMx:wuDWZTpMZSB2IsuEaxckbOXSPU2S52mf
  • TLSH
    T126232A103BE8822BF2BE4F789CF26245867EF5733603D64A1CC4519B5613FC69A426F9
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2