Extracted

• • Target
    a399e8fa17d2f89a47365e5826a3ae1ca50e2f4f91efd5145dd480e675281af8
  • Size 45KB
  • SHA256 a399e8fa17d2f89a47365e5826a3ae1ca50e2f4f91efd5145dd480e675281af8
  • MD5 0afaac0bb1b5cbc63f6a583c337403cb
  • SHA1 d2d054357ff00a30c328ac814d5cca8b965dc607
  • SHA512 dd516587ed37e9f65bf30b561d133bd1773d6ce80e4942757b55a176a4dfba25a08995341f3c295af58e2818ec76945fcabb0946edb73af930d8b56d879aa6a1
  • SSDEEP 768:8uuSpTg7GBoWUSH6+mo2qYCDEbHB0jrOPI/izjb+gX3i6OWNXBYbvYZZoBDZ0x:8uuSpTgyf2qySf3/i3bBXS6HEbvqOd0x
  • TLSH
    T1E6230A003BE8C13BF27E4FB899F26146867AF6633602D54D1CC4519B5613FC69A42AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2