Extracted

• • Target
    aecda217ffdac99596e90c4845cb3a11509265997fcb09ddd70ff836e14cfed6
  • Size 45KB
  • SHA256 aecda217ffdac99596e90c4845cb3a11509265997fcb09ddd70ff836e14cfed6
  • MD5 4f32bb7dcf56d3d4911794ecee2e8b02
  • SHA1 357405672c40bee7fd1f9685b1d0bc1bea641a81
  • SHA512 438787d010d0bc812547aeef95f77a78ba3fd4a411716d7019f18541e1bef5a198ce76e7bc5ace2a47edffcf95095dfb4bb90df58814d3e76c5e2f110658c155
  • SSDEEP 768:4uLZZTUAoOSWUYZL8mo2qFl3xY6AZOOPILzjbkgL3ipyS5s4IY6NBDZbx:4uLZZTUTn20ulO3L3brLScS5GLDdbx
  • TLSH
    T141232B003BEC812BF2BE4F789CF26145867AF2A76603D54A1CC452975723FC696426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2