Extracted

• • Target
    0a3a9ab4476c9fe42cc17aa26b1cacfd67c47cedc39878f969c4454193cd930c
  • Size 45KB
  • SHA256 0a3a9ab4476c9fe42cc17aa26b1cacfd67c47cedc39878f969c4454193cd930c
  • MD5 3d7186e491ec344e2ae4f13c159c8f6f
  • SHA1 b73380451cda9fdbc156580e14adaf6a005c7f83
  • SHA512 9c1674779da7207f8c5e642a64951583eeb36d52b2b063d2b5e1df58e3e3c957082379f1c453fb29383a5c26ba524b4bb749d3165efff732ac1eecb1c2acebdf
  • SSDEEP 768:5udApTNctooWUS7C+mo2qtOdR3aI6OPIuzjb6gl3i3zo+zeBSZy0cCBwNrBDZ0x:5udApTNmU2hjqb3u3btlS30+zNy+Kd0x
  • TLSH
    T12A232A0037E8812BF2BE8B78A9F26145467AF2673603D58E1CC451DB5713FC69A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2