Extracted

• • Target
    bb8d639d15fd754fd13c0c71d05af147b2171693174c9269c79ac9d6d9c3f616
  • Size 45KB
  • SHA256 bb8d639d15fd754fd13c0c71d05af147b2171693174c9269c79ac9d6d9c3f616
  • MD5 0d0a505a82f343d92677f9f218c68fc0
  • SHA1 784fcd975edf993676c87db2b9311c576c81ac1f
  • SHA512 c1a2d83286e2c42f3c9ce133430621588a67e79631a282484f996e050d622f1a8d1ef112558f776c14a7eaa9dbba216d3adc6158de37a54c627b9e8cefd5dbf9
  • SSDEEP 768:MuBGJTP0BQ0UWUWHaimo2qVW9PLzizyvtLjZPIXzjbqgXFikETvstFk0Cow4BDZG:MuBGJTPho2L9HiGVjWX3b9XU7st3Ct+E
  • TLSH
    T19123180037E9812BF2BE4F7899F26145867AF6637603D6491CC451CB5623FC6CA42AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2