Extracted

• • Target
    a6caa97db57c7c2f2b852e19b552565bf57a858df57c32722d4b2e7141c748e9
  • Size 45KB
  • SHA256 a6caa97db57c7c2f2b852e19b552565bf57a858df57c32722d4b2e7141c748e9
  • MD5 17b788e6d7b9d0d2555c12dfcc6499c2
  • SHA1 e7ac3b86ab0e2032d752f19d93eb034690dccf08
  • SHA512 6dd11cf204e76f311ef4b4134f207a17aabdfd7c0b3c8db2b66e3d00a2a6a7e7f571caad48e22e80953fa7b661c752ca721cd814140226d87fd18e31df540ac7
  • SSDEEP 768:4uBGJTP0BQ0UWUWHaimo2qVzsD/pneqPIkzjb2gX3ip6LsGQIDjPBDZ4x:4uBGJTPho2QsjJeTk3bpXSsLsGdj5d4x
  • TLSH
    T101232B0037E8C22BF2BE4F74A9F26145867AF2632603D54A2CC451DB5613FC6DA526FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2