Extracted

• • Target
    a38b8ac4178bf9b3e8b9d8f3954f48f0dd45514cf76cdaf0fd39d6d31862eb72
  • Size 45KB
  • SHA256 a38b8ac4178bf9b3e8b9d8f3954f48f0dd45514cf76cdaf0fd39d6d31862eb72
  • MD5 a6a1a310f9d07a653855e43eb7cf8c82
  • SHA1 cb37b0b99eefe5cfe9f529c567377336bdfdba33
  • SHA512 e53a9509447d497a7f7abd51cd73d66f743bef21ecd48bde265b95f8d7cffd739b716f82928b8d728d675d8f416bbd0ab29fe53f214a5632297bc614d2a4c3c7
  • SSDEEP 768:cuq04JTLcsP8EWUmOTymo2qA02q0CCMPd4CvS8PImLjbYgX3iyqmGzW0L9zR6LEP:cuqNJTLr62ERCEWBmfbPXSv40L9wE1nN
  • TLSH
    T1C5231A003BE9812BF2BE4B7869F26245867AF6637603D54D1CC441DB5B13FC68A43AED
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2