Extracted

• • Target
    a02334978e848bc2fc6e58728b6a5fad9ec2b0acd091c9108f4fd999d9a9036e
  • Size 45KB
  • SHA256 a02334978e848bc2fc6e58728b6a5fad9ec2b0acd091c9108f4fd999d9a9036e
  • MD5 f8bdb0b03963228b12e0ddbf74425128
  • SHA1 964e734d3a438b1135a4d301359a213dec43ddd0
  • SHA512 6189a6556394359a680cc67f0ce77b5c84f43a92ef14f6dc6cefe52529dc2e42b4f40a72b4586d97f27fe5de1e7fa0df252c1088a267b04a0a2864cb07001b89
  • SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFo3xY6AZOOPILzjbGgl3iXt7DahhcdWUk2bBDZEx:MuLAZTnbg2RulO3L3bZlSXBDKcdM2NdG
  • TLSH
    T195231B003BE8822BF2BE4F78A9F26145467AF6736603D5491CC452DB5B13FC68A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2