Extracted

• • Target
    bb5fa686b93c71dac29cfa216730664af944ae946fb6cf455c441b8397a05dd3
  • Size 45KB
  • SHA256 bb5fa686b93c71dac29cfa216730664af944ae946fb6cf455c441b8397a05dd3
  • MD5 f24be65c04c1f67c335f4a353c6194bb
  • SHA1 1a099b6f17a1ad48cd412e2ae9b8cdfa4a9ab4ed
  • SHA512 198dd62ad9dbaecf31030d8151bc1c59df585f7f97a9a3f9de1298a20b58f36aa364b1529818d968a4a17f8ca0941f61d70aa943524391222f8424d12a5e6019
  • SSDEEP 768:cu7m/5THrq+CWUoDuMmo2qFV3xY6AZOOPILzjb9gu3iQfZ8mM4vFWBDZUx:cu7e5TH2A2kulO3L3bquS+8At4dUx
  • TLSH
    T148232A103BE8812BF2BE4F78ADF26145467AF6A36603D5491CC451DB4613FC68A42AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2