Extracted

• • Target
    1a8daee90ed712b2d4f183f09bb1e8ed89335b4d84d2e5018780a8818ab0540e
  • Size 45KB
  • SHA256 1a8daee90ed712b2d4f183f09bb1e8ed89335b4d84d2e5018780a8818ab0540e
  • MD5 de2f3e0f6c6cdf65715c1f25b504df5b
  • SHA1 b4ede44976ba8c505e0e7e13630fa374e3381b4a
  • SHA512 443ab70a83579c4c08a502b88cdc670358b2887bd54e2d7464e4ca0dd1d02975da459db89f4d6e81eaefa7ed4f3c73d0b53adfbb2c9dc34555c89c0cb6cdcc7f
  • SSDEEP 768:5uSy6pTpwrSWWUE3/WImo2qNSiScy3zlOPIxzjbMgH3iRv3j6OKjBDZ0x:5uSy6pTpoo2/i963x3bDHSRfgd0x
  • TLSH
    T18C232A003BE9812BF2BF5F7899F26145867AF6633603D54A1CC4529B5713FC28A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2