Extracted

• • Target
    81693e0a5ae533a684287844b143518156164462d73bcb071beaac5e6bfabdce
  • Size 45KB
  • SHA256 81693e0a5ae533a684287844b143518156164462d73bcb071beaac5e6bfabdce
  • MD5 a354148e0f95655d1cd5abeb36e64634
  • SHA1 59d682a2c76fc3a2aec8a0d77a0f37efba6d254a
  • SHA512 4489072057080de95366d1bbf429bfd9024d37fd6f607c8fc29c28c0284e0d2d649ec4407e5c44cf9c345061bc44c7d73486ca4ff697a226af82c001a693e2d4
  • SSDEEP 768:AuAVhJTDEQAQWUaDyzWmo2q7xGFZQjB4PIFfzjbbgX3i5plnrWHzElZiJbWIBDZC:AushJTDXgH2TqF9Ff3bkXS1CTEjiBdQx
  • TLSH
    T11C23190037E8C12BF2BE4F78A9F26145867AB6633603E54D1CC451DB5623FC69A42AFD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2