Extracted

• • Target
    a0d2a645da262138b096a386f8e740e50efe67a8e7b85582b7a8436785abf576
  • Size 45KB
  • SHA256 a0d2a645da262138b096a386f8e740e50efe67a8e7b85582b7a8436785abf576
  • MD5 4ceba2d6d5d5ac0d8adba5b8b7e1fc7f
  • SHA1 6f7e3c083a3782cbdf648157e5bfa442055d4edf
  • SHA512 407d5be99451327df5a2d5fa00a9c94e2ba4335f0883a4e5a20e96a6963b6daa61e851f397a0d50b6f47ff9f72092e03e07474f185c7d2b3e37ca681f9cc7459
  • SSDEEP 768:4uBfJTMUyYUWUWBDimo2qVvL5P02FUFdiYkk8PI7zjbygX3ifNlkSVkrLBDZbx:4uBfJTMpv2CLDmhB73b1XSfPkSVwdbx
  • TLSH
    T11D231B0037E9C12BF2BE4F7459F26245867AF6733602DA4A1C8451DB5623FC68A436FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2