Extracted

• • Target
    ae9ab7c141d4b4be4869b92a70bbdbfbd6e6202985e4ff14a793b08ddd566815
  • Size 45KB
  • SHA256 ae9ab7c141d4b4be4869b92a70bbdbfbd6e6202985e4ff14a793b08ddd566815
  • MD5 af327b23145c5ba0b9caaf902c3ea15b
  • SHA1 ec5515cbb4304038f29f68fee06c1896a45ddc40
  • SHA512 850176156cf752633caebecef04091043fa46bc9d1c302c68f76dcdfa339df7c2dcc36d451a948f03694b3e2a4ec823728f3b4750d39b9010ac3cecb51661b29
  • SSDEEP 768:8uuSpTg7GBoWUSH6+mo2qY2W8aIXOPIKzjbxg23i0wzGUahmv0t7uorB4yBDZ0x:8uuSpTgyf21Fu3K3b+2S0wyF8Mt7xfd2
  • TLSH
    T130231A003BE8813BF2BE4F7898F26145867AF5673603D58A1CC452DB5613FC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2