Extracted

• • Target
    a281cb493bce04520b9909145c9ffe9ea8a40071a891aad0d8cad4122f80e3a5
  • Size 45KB
  • SHA256 a281cb493bce04520b9909145c9ffe9ea8a40071a891aad0d8cad4122f80e3a5
  • MD5 706a2e2718d05b4e9d3bf6eef21ba44e
  • SHA1 1386d1115d084922b182d006a46b2ebd11eb1e4b
  • SHA512 e901291b6719cfce95d9eb37389c5aca33b00ea94cca0fc6a539e3abeb21cf9ad22c9e9e96d9eea49a19c98baf3ebf9466c6526d3180d4ec9aa54bde79c1a3ec
  • SSDEEP 768:EulCJTHESwgWUK3aGmo2q9ORt3wtOPIIzjbwgX3idHcCI7deeBDZsx:EulCJTHl42PRs3I3b3XS9wdsx
  • TLSH
    T187232B0037E8C22BF2BE4F78A9F26245467AF6673603D54D1CC451DB5613FC68A426EE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2