Extracted

• • Target
    a1ed0de00c750c5cff5989be02af6ad2a6353a6bc5a6ce38a0e687de2bdd9ab1
  • Size 45KB
  • SHA256 a1ed0de00c750c5cff5989be02af6ad2a6353a6bc5a6ce38a0e687de2bdd9ab1
  • MD5 9c3b04eaa6c5ddc2fa3669047beced55
  • SHA1 2be3616e3629d68d1d99f7ccb287d3b1e800b045
  • SHA512 afdcad56369d0c8056e489893fc565770b8c23ea19d28b0db66ece96d49fcbb628306eb60b9f256b9d1e0352ae105ac51a2741a8bb93aada1d122a8c44f673cf
  • SSDEEP 768:EufspTfzcR6uWUcb+wmo2q97S7synzuOPIzzjb9gXeiqIs5R+0kBDZsx:EufspTf2g22SYh3z3bqXnqrW/dsx
  • TLSH
    T121232A003BE9C12BF2BE5FB899F26145867AB2633603D64A1CC451DB5713FC68A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2