Extracted

• • Target
    aeb26ce3956d413f2e03a2d443475499459818d1f5057a38598c14f190ad71e2
  • Size 45KB
  • SHA256 aeb26ce3956d413f2e03a2d443475499459818d1f5057a38598c14f190ad71e2
  • MD5 0f7fe1348ff17241312c6adfffdbe8e6
  • SHA1 ce3bf60e6dc636329620838cabcdb330bf6c2880
  • SHA512 4e8dac4a5f7ce44e5ba21427f8a1a1c244b7cff043605393064a8460d1c819810cea761a4556b29d7a52db0a53c46b26e28e82313ebc9c35319f91c87fd0a9db
  • SSDEEP 768:5uSy6pTpwrSWWUE3/WImo2qNHoopCBK9INJPIZzjbYgX3ievmjigP8M4xecUBDZ2:5uSy6pTpoo2So6bIwZ3bPXSdjiKV4xe8
  • TLSH
    T165232B0037E8822BF2BE4F7499F25145867AF6636603D54D2CC452DB5713FC68A42AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2