Extracted

• • Target
    a017505e97c257f8f9b28b09f95a7cee9ca32c383eb1b27896dce9187e78108d
  • Size 45KB
  • SHA256 a017505e97c257f8f9b28b09f95a7cee9ca32c383eb1b27896dce9187e78108d
  • MD5 bc8b5233b492070677caa22aeba458dc
  • SHA1 d88b44b210ab286c721148eb1efa6d33289dfcf1
  • SHA512 9cc6c7c9d13f02e1c2a3569d8ffaf9fe9e2779cf65f6a5b7d9422a36b8983cd3b3633d3c2306681203a46d93ae83917d7265c8e24d0bdb55f6bd66a089f0ddea
  • SSDEEP 768:cuqb5TrIGuCWUoKXMmo2qQol9fcBEahPIt3jbkgX3ibjUnx8Z3MBDZUx:cuqb5TrhG2ULkEa+tTbrXSbjujdUx
  • TLSH
    T1F3232A103BE8822BF2BE4F7858F26145867EF6636603D5891CC451DB5723BC68A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2