Extracted

• • Target
    a5350f9663b9cee5892226e3d80741788d09bf1ba2f6d36cb1c1a180a834914d
  • Size 45KB
  • SHA256 a5350f9663b9cee5892226e3d80741788d09bf1ba2f6d36cb1c1a180a834914d
  • MD5 fa90ef6cd9993d2850fcab82e9d06e67
  • SHA1 e49a8174141048ac647c11fdff7f70bdc882d9bf
  • SHA512 5154b376d5311c45f58db8fda75e2c42cac4042157de5a862ab7ded25f9f6240a4de4611ac25ccfe317a958db374f2b62a3cf43f41d52ecbcf38afcdc05cee5f
  • SSDEEP 768:0u1YJTHwAUgQWUaT2Wmo2q9moRQKIJOPIhzjbZgQ3i/ogesJfnvFBDZ8x:0u1YJTHcw2ZYxg3h3b2QS/ogjvLd8x
  • TLSH
    T111232B0037E8822BF2BE4F7898F26145467AB6673603D58E1CC451DB5613FC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2