Extracted

• • Target
    aad3cb43c4afa709f21f6a22d99d6004853db17a457d22b14a17a52d5059c772
  • Size 45KB
  • SHA256 aad3cb43c4afa709f21f6a22d99d6004853db17a457d22b14a17a52d5059c772
  • MD5 6885746f6c067583893f7e605db69f83
  • SHA1 8896ee36c97a1c4272520946675b6c68bbea5f97
  • SHA512 f2a1aae6be1cad7c935a4dc74fad6a9f71670f3db4a28e4541a36a5014c337b000e37a3d1130263ce7eb0557d8a2435dca40448d8353cd8dd78cac40e528e937
  • SSDEEP 768:EulCJTHESwgWUK3aGmo2q9tCSwTMjPIufjbGgX3irKo8TvIFgU+fC6BDZsx:EulCJTHl42ag1urbZXSrKHygU+Jdsx
  • TLSH
    T135231B0037E8C22BF2BE4F78A8F26145867AF2673603D59D1C8451DB5713FC68A426EE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2