Extracted

• • Target
    bb97f634ce6f59f987780143b5cb9827aa9e8265eeb2c5657b8304c2e65386c4
  • Size 45KB
  • SHA256 bb97f634ce6f59f987780143b5cb9827aa9e8265eeb2c5657b8304c2e65386c4
  • MD5 d1604aafc4165a46e3e65dbae845135d
  • SHA1 a05c5c96f15886e5f9b5365055034b6efe8b3251
  • SHA512 472495b5d0841de7a3d9693d74c0124f3c459dfc5f26cd553b614f40de59424655cbad50c8474fed64633d49a4ad9390132c359747f0260faa273313e974cf87
  • SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFEfBohEaEPIQYjbHgX3iLBu3yKdCo2uOBDZEx:MuLAZTnbg2Z4EapQQbAXSLBoyKadEx
  • TLSH
    T14D232B003BE88127F2BE4F78ADF26145857EF6B32603D6491CC4419B5613FC69652AFA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2