Extracted

• • Target
    0e92a37744407625c007784ead1b3ff9b69ababb46bbf7e8bab2f130d8fee145
  • Size 45KB
  • SHA256 0e92a37744407625c007784ead1b3ff9b69ababb46bbf7e8bab2f130d8fee145
  • MD5 f7809d159a0393a56c16c415ccaa0c7e
  • SHA1 3f4499865da6dcd1ac39a7867caeb298d5955309
  • SHA512 e92c8ad37ce4ca030a1720eb1696a31023b7db1ef0859f6f9fdb230a56ff21019b7ae979c69338efa0f3ad1941e89879ae663a360ee40d39d69a3605cf624819
  • SSDEEP 768:Au1YJTHwAUgQWUaT2Wmo2q90GFZQjB4PIFfzjb0gX3iJtLr8+edL2DegEnZBDZQx:Au1YJTHcw2MqF9Ff3bbXS3I+MSvEHdQx
  • TLSH
    T151232A0037E8812BF2BE9F78A9F22145867AF6737603E5491CC451DB5623FC68A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2