Extracted

• • Target
    a98b4d157d02ae50eeeba3f3648285612cb1a731bbeb0bdd4fc5d99a257e43fc
  • Size 45KB
  • SHA256 a98b4d157d02ae50eeeba3f3648285612cb1a731bbeb0bdd4fc5d99a257e43fc
  • MD5 cf79e9d378b36b354f6f4c3c22e8f11b
  • SHA1 864bce399c94be86d0d94190f8ef07198c4bf25b
  • SHA512 ef6f28d14870dac66554ec28861582340c0a547ad56cec9b8309d864524e8613da5eeecd5b898edfddf0b38109653d6dd81c33eb48e504e422ce53ad088bad20
  • SSDEEP 768:0uPrpT/LGKeWUszuAmo2q9qqTkafz+OPIEzjbYgXvin8c/RlqaxIBDZ8x:0uPrpT/qY2nqoR3E3bPXKXxud8x
  • TLSH
    T110233B003BE9812BF2BF4F7859F26145867AF6633603D6491CC4519B5713FC68A42AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2