Extracted

• • Target
    a2919a1834d61c01f53452b69c80c524692f21607afe9e76fda36b5f1f4915f0
  • Size 45KB
  • SHA256 a2919a1834d61c01f53452b69c80c524692f21607afe9e76fda36b5f1f4915f0
  • MD5 819a718e17380a9da3ed4f0be742208a
  • SHA1 771d42843ae8805583bdf28e1a80892c4280e51d
  • SHA512 d689656202fbd483aea1947bfa281f7af4c342c9c314dc53266d3601ba57aad3cbda0f0cfd0ea0b347b6936bbcbbf37db90a355a8766b3cf88b6f72404f76c43
  • SSDEEP 768:EufspTfzcR6uWUcb+wmo2q98wD/y/aqPI+zjbNgX3iCHO2sMHBDZsx:EufspTf2g23kh+3baXSV2sydsx
  • TLSH
    T15D232C003BE9C22BF2BE5F789DF26145867AB5633603D68D1CC4119B5713BC58A42AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2