Extracted

• • Target
    a0eb89bc4cc34d07d0d04efbfec8c2e702774ebc622c18f398b41e4597530d32
  • Size 45KB
  • SHA256 a0eb89bc4cc34d07d0d04efbfec8c2e702774ebc622c18f398b41e4597530d32
  • MD5 adb044c7a5227b2cb63db3617e9cd8c3
  • SHA1 635d6fe81fca0a8903c4ca48e553617e55991046
  • SHA512 c17959501e33d471bf46898dd57a19f8994b221dd035420ae53647094ff89c6f35d9e670e8245ea5173bf8a200a393e0fe9cb8ce04abcdd6913bff886b14a9be
  • SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFo3xY6AZOOPILzjbxgK3ihJRC+shbBDZEx:MuLAZTnbg2RulO3L3b+KSTshNdEx
  • TLSH
    T19F233B003BE8822BF27E5F78ADF26145467EF5672603D5891CC412DB5A13FC68A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2