Extracted

• • Target
    b914b1daa36f9a9142ccd1c82a208877f3f43ddf3b531b41c1da66b7a25cfd7c
  • Size 45KB
  • SHA256 b914b1daa36f9a9142ccd1c82a208877f3f43ddf3b531b41c1da66b7a25cfd7c
  • MD5 da37177323ef192aab27e9114a75d1be
  • SHA1 6de3531bf3c753e343e2fa90a4874c1ebe2ecbe3
  • SHA512 9f477f05b3e16b0d92fde1e4b55f57e2fd40a2e5eb31969189824f8a0ed851e3bd5c30485a6c8cf2d5231fb27cd605f29b0c5f182e495ce2887f05b4688fc4f9
  • SSDEEP 768:UuKWgSJTwU6NkWUGnaSmo2qAmxGQG9PHuPIczjbEgb3iBXpm723Fb/BDZcx:UuKWgSJTwRf22HC3c3bLbShpk2pJdcx
  • TLSH
    T138232B003BE8812BF2BE5FB898F26145867AF6673603D54D2CC451DB5623FC6C6426EE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2