Extracted

• • Target
    aed1bc0cf4d3c8a2563fe6f78dcb5656e1311445f3fb764e859ac9ef4e974704
  • Size 45KB
  • SHA256 aed1bc0cf4d3c8a2563fe6f78dcb5656e1311445f3fb764e859ac9ef4e974704
  • MD5 dfb7503ca5b58f93aac7df2bea514389
  • SHA1 cb16f667fc632e1cf234efb1031235325ceac8c8
  • SHA512 ff1175d73da66e10d59234d0b1ff6aa1b4b3798f973ec6bc0e8192164a55bbb66ce79e06753d6405234e3e4aff3d4adeabf362a927ced5b9afde3eff89c10620
  • SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFPUJ+XOoJ9hU/NPIEfzjbXgX3i1NgIBmsYq59BDZEx:MuLAZTnbg2CU0eI9hyqEf3bwXS0vsZdG
  • TLSH
    T129231A003BE8C12BF2BE4F78ADF26105867AF6632603D55E2CC4519B5713FC696426EE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2