Extracted

• • Target
    bc55291e11d442b7d1798df58faa939e698dcfe33e1a55911afe639e83a0b74b
  • Size 45KB
  • SHA256 bc55291e11d442b7d1798df58faa939e698dcfe33e1a55911afe639e83a0b74b
  • MD5 a54db076bba4cb94ac57b3a2495d8727
  • SHA1 39ec716b94483094442028c48d9932ec1894e6f7
  • SHA512 8fc9d86dcb1cc1431d1f3dc25d02543d322415bdfc7c424276ec2b9ec14a3d2d55fa3106eec5fdea8b8afd450600d7f8cd5fc4d8155ca7524695fa01cf4a8232
  • SSDEEP 768:suJdpTP3tcsWUODmqmo2qV2maPclm3API7zjbzgX3iN2ACecUAdz7p2bB7fBDZkx:suJdpTPdI2HfcE3l73bsXSjCe/A57q9u
  • TLSH
    T1D823190037E8813BF2BE4F7899F26145867AF2676602D64A1CC451DB5723FC2DA426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2