Extracted

• • Target
    ac0e7664224f9462cc2d96b0eb306bdfbc1b3134083cc876f7cb7e5e29fd6432
  • Size 45KB
  • SHA256 ac0e7664224f9462cc2d96b0eb306bdfbc1b3134083cc876f7cb7e5e29fd6432
  • MD5 e74d153e2667cfa1009ba039e429b98a
  • SHA1 41b999f50b3f0540d022dfe14d8a8e1fcdf6b02d
  • SHA512 402cff9b93de716d64dbe5c2dc27edf0769d637cbeb76a2aaeb6d2f75de89c1161f50208d56e48ea36e9f666f13c993b8f6ce86e4fa4b1591331f6116b8877d9
  • SSDEEP 768:ku40ZTX3uXTaWUgzW0mo2qwXzdAAyPMlL8TfPIMWzjb/gX3jUE7HuLkhBHBDZMx:ku40ZTXEb2PlvlL+4MW3bIXzUSHwkpdO
  • TLSH
    T127231A003BE8C12BF27E4F7899F26145867AF6732603D68A1CC451DB5713FC69A426EE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2