Extracted

• • Target
    aad5f6202210d334e5908ca0f68fa52c431c61cdc27d446900100fa244aa00ef
  • Size 45KB
  • SHA256 aad5f6202210d334e5908ca0f68fa52c431c61cdc27d446900100fa244aa00ef
  • MD5 832f07b0c23a24c394382bc4c5516e9f
  • SHA1 e78a15c0028d9dccf0abab6097c666e30c6bd06b
  • SHA512 36cd17413e905e6115592a5a97322c6e15f65dfaa7d8703e6841280c148439abdd35e4d98033f024920660c858adb863903c4dff6fdfccfe67902e6c577e3478
  • SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qF1Nd3u40cMOPI04zjb2gXZiNwyHvpcBDZEx:MuLAZTnbg2m8+M3043bpXoNnB6dEx
  • TLSH
    T1F5232B003BE8812BF2BE4FB89DF26145867AF5732603D54E1CC4529B5A13BC6DA426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2