Extracted

• • Target
    ace2613164497bb0fda2e3544ba8ec657a509dd352ef5e6a7c07cc3a00954781
  • Size 45KB
  • SHA256 ace2613164497bb0fda2e3544ba8ec657a509dd352ef5e6a7c07cc3a00954781
  • MD5 e28e28c278f9e03e8867692d68d5cc30
  • SHA1 4d81aaa2dc60b7314e8545b498020931a2f232ef
  • SHA512 7c0c2b4eccf9901f9b5c9ccde4b069486093fb8f017b09434a7865ae92d999151b1fa82b6c3811c0186b29158b2eb00331d6b8c48ec22be861a54720e7747d31
  • SSDEEP 768:MuBGJTP0BQ0UWUWHaimo2qVMTkLGu5vQl9wZPIrzjbCgX3i7vL5pKNqhf5mveiDm:MuBGJTPho2pT/uRqwWr3blXS7D5E2hmE
  • TLSH
    T156232B003BE9C12BF2BE4F7899F26145867AE6736603D5891CC451CB1613FC69A42AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2