Extracted

• • Target
    a24a11755731be64bef33b5cdd502afc17a8124c45f594038af6cca3b195684b
  • Size 45KB
  • SHA256 a24a11755731be64bef33b5cdd502afc17a8124c45f594038af6cca3b195684b
  • MD5 ef7007440b25b5f7c13d16864baf08cd
  • SHA1 08d4d30e0caf650f51d08548cc490be95629c248
  • SHA512 085ba4408ff712c3725d0dc0abe5c0f46d87d03f8130a1dca93499685bb00f3a80daf2827b2bdd8e49c6f79c6a763efcb20a8d14404e8e79734f3aab8c129aa0
  • SSDEEP 768:vuogpT78XvEsWUOsRzqmo2qrYBz3QKx7PIQnjb8gX3i0NwBTtjY95BDZkx:vuogpT7I627V0QjbTXS0N0Ttjudkx
  • TLSH
    T198231A003BE8C13BF2BE4FB85CF26145867AF5636603D9492CC451DB5623FC6DA426EA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2