Extracted

• • Target
    ae7fca57745093297550e94fdf3951cb52557af8024286c9229d2514784cf0ad
  • Size 45KB
  • SHA256 ae7fca57745093297550e94fdf3951cb52557af8024286c9229d2514784cf0ad
  • MD5 24860c670f47c8bead79fa3139ef33d8
  • SHA1 1331cdec18ed543c86c68ec63af3eaffc756e150
  • SHA512 03efcc08a56603eac9dc06b1174e1a9c20e94c4425dec85bef73f67885dc14f5273382aae04d3df6df8f5a11828d17aa7c3306425418311afd611e1943867bd0
  • SSDEEP 768:vuogpT78XvEsWUOsRzqmo2qrrb3/GYjHuPInzjbtgXOi6Qml3YLRlEKmuzXKeOHp:vuogpT7I62gL/3n3b6X36QmqjEs2ZHuk
  • TLSH
    T163233A003BE8812BF2BF4FB8A9F26145467AF5637603D58D5CC451DB5A23BC28A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2