Extracted

• • Target
    aa1833355090f26fb0b5d2adacd5329742ffdafcfed16435b73a5e8ac8208d98
  • Size 45KB
  • SHA256 aa1833355090f26fb0b5d2adacd5329742ffdafcfed16435b73a5e8ac8208d98
  • MD5 15c6eccc5e753045ad3ff9ee6526b9eb
  • SHA1 447250e7ccb354ec4cf547c7343a089e31eebef9
  • SHA512 d884d489b445cdfa6854f9d53431f6bdcae9595e1e7872001d358bec713c5ee18e33c9af8b61fe12ea0468016a9c2d74c0d91b99bcd2882b95b05f68569f8228
  • SSDEEP 768:QuflpT8AkKuWUch7wmo2q9rwz/y3qiPIIzjbpgX3idw27j8/FtMltle4fBDZTx:QuflpT8Hv2o0hI3bmXSpafMlu6dTx
  • TLSH
    T19D232A003BE9C127E2BE4F789DF26145467AB6633603D98D1CC411DB5723BC68A52AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2