Extracted

• • Target
    a4825d822e9929dd47d893868ba5792a9677f9886c3616debcfd97e55e3da813
  • Size 45KB
  • SHA256 a4825d822e9929dd47d893868ba5792a9677f9886c3616debcfd97e55e3da813
  • MD5 6de7c50e3fde584b779a3ec01246e37d
  • SHA1 6bcf429d288a4913e8faedfc8b404fdfc2c64301
  • SHA512 6e9ff08bea9e9fe813147e8842f5dd92d7ff75ff6c1104314dce8bceebd493a24a66034273546798ba7a363683fbe5617b41e3df30107355c9d09c634af8065e
  • SSDEEP 768:UuKWgSJTwU6NkWUGnaSmo2qAeb30GYjHuPI8zjbggXHiNSaHy/I+Ka7FTfCBDZcx:UuKWgSJTwRf2uw/383bHXCNSqj+nNf8s
  • TLSH
    T1E2232C103BE8813BF2BE5FB899F26105467AF6637603D5891CC451DB5623FC28A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2