Extracted

• • Target
    ad5a37852810c058d643eec1a6fa4744e8d8f5441a414867f4333720a080fb87
  • Size 45KB
  • SHA256 ad5a37852810c058d643eec1a6fa4744e8d8f5441a414867f4333720a080fb87
  • MD5 b077c93dbe4c8393d68aabff73576b7b
  • SHA1 f0b9b00c040f4ac7ec3d11594aaefc237110b27c
  • SHA512 410eae404e58561ab66402c45b4641bd92b36ae4d80ca841dbc29551ee45000b223f4e5a44677e1f36605968eb3fb97607e36a0e4fd4446b112a445c0124093a
  • SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFEfBohEa+PIvJjbWgX3iH/I2FyW3EEZh90Uw1d2BDZG:MuLAZTnbg2Z4EaHvpbJXSHMW3f9o1WdG
  • TLSH
    T15B232B003BE8822BF2BE4FB8ACF25145467AF6B36603D54D1CC441DB5713BC69642AFA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2