Extracted

• • Target
    a2c85f4b451538e93114892ab60bcce69886aa0f98d061759eaa2807c7e2dc19
  • Size 45KB
  • SHA256 a2c85f4b451538e93114892ab60bcce69886aa0f98d061759eaa2807c7e2dc19
  • MD5 a00c2fdfb2fb5a15ad047f6ee4f741b9
  • SHA1 f483c20f34c0097cb363a001653a69889f44cca1
  • SHA512 5ff7a112dcf92dfc7bb64a57326287a5d05fed4325ac9a701fe8600c9f466d8d80d70e5702d8bffb5064b0d485a19ac50bc71f75ec2a61ce1c996062561f1511
  • SSDEEP 768:UuKWgSJTwU6NkWUGnaSmo2qAvT9Qpm9PI5zjbXgX3iYwuyfX2WwXzXPBwsnBDZcx:UuKWgSJTwRf2hQ53bwXSLmWwXzf7Bdcx
  • TLSH
    T1A52319003BE88127F2BE5FB89CF26145867AF6636603D54D1CC451DB5A23BC6CA426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2