Extracted

• • Target
    a83373fe2f434b4d2af5427f7e2f1dad75685b2a9dfd5d1e11169d411ae7eea3
  • Size 45KB
  • SHA256 a83373fe2f434b4d2af5427f7e2f1dad75685b2a9dfd5d1e11169d411ae7eea3
  • MD5 a38ffd7324ab7271637efa6a7771fe89
  • SHA1 587f93641ea47a63c8715a80ab0e34a15fb000ae
  • SHA512 d912e692c40d0b4a4bbbe697be949be9896c416cdfc7972dc0bc8dab85efee062e5e1905eead16a9e609fab3ecc1eaafa2a8ca58d99159caf18d38a64311f299
  • SSDEEP 768:5uSy6pTpwrSWWUE3/WImo2qNrzjHynaKPIsNjbWgX3irDM5tboNAlusPBDZ0x:5uSy6pTpoo2onZsFbJXSrDAZd0x
  • TLSH
    T113233A003BE9C22BF2BE4F74ADF26145867AF5632A03D54D1CC4119B5613FC69A42AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2