Extracted

• • Target
    a373cf3281c03d61b80f744ca5964929a834760d0d380159faaa2fbd79a998b8
  • Size 45KB
  • SHA256 a373cf3281c03d61b80f744ca5964929a834760d0d380159faaa2fbd79a998b8
  • MD5 50e1061a0621fe41e4ec51f8fd783c46
  • SHA1 7fc285d67dbf01051d9e26adc1017227b647e50a
  • SHA512 2eb848faf7e49131d9ca099dd4fb2717f630f70c5560dad54c3175327a457dad97d37d21ac5a749b7ac862998ce4ba400579c7b1718c1ce3dcee5b8966191cf8
  • SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFMSAFcKoabbb4ZhM/RPIAEzjb6gX3iaP1XBDFud+wDm:MuLAZTnbg2vSAvQZh6OAE3btXSC1XFFZ
  • TLSH
    T1F0231A003BE8812BF2BF4F7898F26245867AF6633603D95A1CC4529B5713FC696426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2