Extracted

• • Target
    a5b15ce3166e4d56d699375e7a0568a0ad9075c910ef71d4cd83c9e458c16459
  • Size 45KB
  • SHA256 a5b15ce3166e4d56d699375e7a0568a0ad9075c910ef71d4cd83c9e458c16459
  • MD5 9c5801507f23248205bc65374c78bf58
  • SHA1 814752eaf07ef794a2a95ac782e3c9669c871352
  • SHA512 4de60af086adb08bb676ca290d45a025d69a25155cc99f1037c9d2309cdb2759f2162a9e6d6645d9deb1cddae3613e2fa25720319240bf151e300a4e90597a52
  • SSDEEP 768:0uAVhJTDEQAQWUaDyzWmo2q7QDEbHBijeOPI/TzjbPgX3iRT6JGB7CGxMvFBDZ8x:0ushJTDXgH21y4i3/T3b4XSwGBhx8Ld+
  • TLSH
    T18B232B003BE8C13BF27E5F7898F26146867AF6633503D6891CC451DB5613FC69A42AEE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2