Extracted

• • Target
    30aa461db5a190c4f1491fa6b7fabdaf0fd44ed99492b8bffbd117f1db1fb2e0
  • Size 45KB
  • SHA256 30aa461db5a190c4f1491fa6b7fabdaf0fd44ed99492b8bffbd117f1db1fb2e0
  • MD5 edc00ad844dfa8849ca3c7b6b1547c8f
  • SHA1 667ff16c8b9f58b8544b77f8ad1443440f59b24b
  • SHA512 6ccb22d1fd066d185582600175645f9f4d5878f6a5ce46e9108bea15010dc78de7f55da2899602026cf803ad56dc07fc270b2b6e2a07d6975b9425676320441f
  • SSDEEP 768:0u1YJTHwAUgQWUaT2Wmo2q92CHyTtUPI7zjbhgX3i/dJjVmVbibpBDZ8x:0u1YJTHcw2Bnj73bOXSlJxvd8x
  • TLSH
    T176231B003BE8812BF2BD4F78A9F26145867AF6673603D54E1CC451DB4713BC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2