Extracted

• • Target
    0a135ace4be3f13adf279c5fb6c5fe69a291039cb80a29c86534192a7c3aba1e
  • Size 45KB
  • SHA256 0a135ace4be3f13adf279c5fb6c5fe69a291039cb80a29c86534192a7c3aba1e
  • MD5 b39fc62af6b14d25ad286cbe019bf939
  • SHA1 bc7bd9e26bc5b0e6c7d25b99d9b787593c594116
  • SHA512 90f1ec38842c5a865b74636e0ef58b7524afbc20d95f046467d62cc117e1f6d154013ddd49f3c92d4c365ba1a7c6816c6165610caff99fd4ec8f25896858a59d
  • SSDEEP 768:EufspTfzcR6uWUcb+wmo2q98ITnyHaaPIozjbMgX3iNaCBoKBDZsx:EufspTf2g23E5o3bDXSNaCBoUdsx
  • TLSH
    T102232B003BE9C12BF2BE4F789DF26145467AB6633A03D54D1CC411DA5623FC68A52AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2