Extracted

• • Target
    ae5c18b10fabb5c2e93f01bf6f9c8ffc901f2bbf2ccc1f5fb3557c24be319ddc
  • Size 45KB
  • SHA256 ae5c18b10fabb5c2e93f01bf6f9c8ffc901f2bbf2ccc1f5fb3557c24be319ddc
  • MD5 b8a4c5740b154ec90596b3205dbf2364
  • SHA1 bd989d916b09476c08eb61e5e03f16c90559c6a7
  • SHA512 3606042ccb4a67f67261ddea51846849b5e320952800f7908b91d39c7d00a797ff39ba778eb51f9179d4d8068bb1441b79b58e1eaac505c74b57b013c5c319dc
  • SSDEEP 768:rukO5TkI7ZzWUTZ9Fmo2qTOeeXK5o5TN8/nPI6EzjbvgX3iXwhHUoTR+BDZ0x:rukO5TkUH2YeEoTNKA6E3bYXSAh02Qd2
  • TLSH
    T165232B003BE8C12BF2BF4FB899F26245867AF2772603D58A1C84519B5713FC68A425FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2