Extracted

• • Target
    ba4db930ef865661d1193c6153915e37cac4d658bb76cf01479610301c54bc7f
  • Size 45KB
  • SHA256 ba4db930ef865661d1193c6153915e37cac4d658bb76cf01479610301c54bc7f
  • MD5 dec39c694046b26dc9d6b7e1492e4531
  • SHA1 4014f0c11540b67a3c6e830261b8fbcc49afa037
  • SHA512 aae04a1d17257f6fe5e19289fa5330d0edd8cd30dfe26dd1f4ca63aa5a0d85369707498d0bda054a0ef661721cc672ce6625d58bf6b7cbac9744e0951086af71
  • SSDEEP 768:0u1YJTHwAUgQWUaT2Wmo2q9PG1HJhOPIcxzjb0gh3iWU7LAPL+aA5BDZ8x:0u1YJTHcw2rFj3cx3bbhSV/APLSd8x
  • TLSH
    T1A2231A003BE8822BF2BE4F789DF26145867AE6673603D58E1CC441DB5613FC69A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2