Extracted

• • Target
    a0423c9fccbf281890f3c0f40e35d67cae4697cd304a5378c707b0ebec0a5a97
  • Size 45KB
  • SHA256 a0423c9fccbf281890f3c0f40e35d67cae4697cd304a5378c707b0ebec0a5a97
  • MD5 ba7cd2a31fd5eaa5722d398d10a1f1f1
  • SHA1 46e7073ccd4db16951be4999802f6489fadbe622
  • SHA512 3f499ae2c7a77a405a2e6b4d745ef70ebc0827a95fbde992a65ee86a872b76c97190c364a525869fb38c0f7315b53d48e220d33c0902721fad80c538183fd513
  • SSDEEP 768:QulLJTEs+EgWUKJTGmo2q98COtTMtPInzjbZgX3iSBuK61RtkBDZTx:QulLJTE9X2jRvn3b2XSwuKHdTx
  • TLSH
    T1E6231B003BE8812BF2BE5F78ACF26145867AE6673603D58A1CC441DB5713BC6D642AFD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2