Extracted

• • Target
    534aa83a781c381dc275e74c53949113c108d5ac2a7a8b9ba9850f84d71dcd6d
  • Size 45KB
  • SHA256 534aa83a781c381dc275e74c53949113c108d5ac2a7a8b9ba9850f84d71dcd6d
  • MD5 a191e6f6fa0bb9fdc652c67b42fe76b1
  • SHA1 0572543ddbd2700fba08cb19df1939b5a461e313
  • SHA512 f06502d4b8dba17da84729a7ea3dd0ae9845841502040b9ef0ea592c21e84fdff0c04a4d5aa2fd150a5b9591a3094b5cf84771ae2bf9f657749d1366b887b46d
  • SSDEEP 768:EufspTfzcR6uWUcb+wmo2q98zjHynaKPIsIjbDgX3ic0Mo6Hrq8U6BDZsx:EufspTf2g23nZsgbcXScg6Hddsx
  • TLSH
    T1D1232B003BE9C12BF2BE4F789DF26145467AF6632603D6491CC4519B5723FC68A42AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2