Extracted

• • Target
    080b4119cad04b959c6773d25ad1b72ec4997f0a2cecc8a61ccd98eb7394fc39
  • Size 45KB
  • SHA256 080b4119cad04b959c6773d25ad1b72ec4997f0a2cecc8a61ccd98eb7394fc39
  • MD5 37c284af24f49bbbc380655f86442b83
  • SHA1 b1a495e577bfc92d655801b5f171a1ac9e5c52cd
  • SHA512 6e9eb0a6643ac7c9bb8c55f3e173b31962067bdfed61ba453cb1d8d165d9c5d88fd8d361ee91d29aa2ba90c5935ada38c14426d54ba36336371dd268292891f4
  • SSDEEP 768:cuR0JTPUYkEWUmjWymo2q1fLiE0yFjrdj3kk8PIhYjbFgX3i7lIpdDdD2egNtTQ2:cuR0JTPjY2SLBXDBhQbCXS7apd5DIhG0
  • TLSH
    T119232A0037E9812BF6BE4F78A9F26245467AF6733603D6491CC441DB1723FC69A436EA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2