Extracted

• • Target
    bd5cd126d0d24f25e2cd374bd5b53c85382b1d152575a60353fc99cc8bfdabd8
  • Size 45KB
  • SHA256 bd5cd126d0d24f25e2cd374bd5b53c85382b1d152575a60353fc99cc8bfdabd8
  • MD5 705153b136625471a4fe43d0b7810d03
  • SHA1 b51bf1be495dcd9eb28e645ebd2633ae4985e188
  • SHA512 f3329f9d516d018438c85e5720f7c01ae7a6274ca388bbe9b0f2dd341db70514c93cc5f44dce02d4fadcde2b554fe5bd03c4cce839a2b53ef011b5d36fda5ed5
  • SSDEEP 768:wuDWZTpw7bmaWUg3gSk0mo2qlLlsHoPEaMPIGzjbIgX3i9yf6exMgL4/K3NYZBDo:wuDWZTpMZSB2OuuEaxG3bfXS9XeWgL4G
  • TLSH
    T103233A003BE8C22BF2BE4F78ADF26145867AF6732603D54A1CC4119B5613FC696426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2