Extracted

• • Target
    a6ae0d7e17b24c7ee7a5e4b2335f0b1d5fa3930eb085d1a1cb1d80d70b4b4efd
  • Size 45KB
  • SHA256 a6ae0d7e17b24c7ee7a5e4b2335f0b1d5fa3930eb085d1a1cb1d80d70b4b4efd
  • MD5 3388d2863c4f9663f361f4f11044ca97
  • SHA1 b70eaff8c80c10954d7ba83f9f158bea7dfc1ab5
  • SHA512 6d8b31773557364656af8ba777e894c98eaa301675cafe1bd1bb86471eb2552f8b44d1ebf9b65d0e411ae1756d3175e993d961c908a03a26e8bce9f908fba980
  • SSDEEP 768:0uPrpT/LGKeWUszuAmo2q9zwD/y/aqPIbzjb4gX3ip/bZXIYTI5dZBDZ8x:0uPrpT/qY2Qkhb3bvXSp25bd8x
  • TLSH
    T136232A003BE8812BF2BF5B789DF26145867AF5632A03D64A1CC411DB5613BC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2