Extracted

• • Target
    aa106cde0fb072c39cb3bc0617995ea456be08da667cc209cf60293c0ed08a28
  • Size 45KB
  • SHA256 aa106cde0fb072c39cb3bc0617995ea456be08da667cc209cf60293c0ed08a28
  • MD5 031561bf8c71fbca887c1458b863ff4d
  • SHA1 dd1e5003075a0f91a7ce2f6eaa359665d60153ea
  • SHA512 f199a225c1c6fdb508d126312ec30be4fbb115251a5b6518436a5d2e83047fbf65122c6a0aa6298bacac8bb8093f3da12f49305889816f27dabc9cda81c56c7a
  • SSDEEP 768:ouuSpTg7GBoWUSH6+mo2qYZGFZQjB4PIFfzjbsgX3iz1nWjOGwMBXMSaM9JAZBD0:ouuSpTgyf2kqF9Ff3bjXSz1nWijMBaMX
  • TLSH
    T170233B003BE9812BF27E4F78A9F26145467AF6733603E5491CC441DB5623FC69A42AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2