Extracted

• • Target
    80b0cec3efa06f49bb804d4b89c460ab12319bfa02651f71fd00355399297977
  • Size 45KB
  • SHA256 80b0cec3efa06f49bb804d4b89c460ab12319bfa02651f71fd00355399297977
  • MD5 272fd4423e0ce83ad5efc72bd3e70a97
  • SHA1 f25a3a662992f0c166e884957be4d3a259d67e15
  • SHA512 80d7261f86d9d4b6d77d9ffb6329d2d4812419358db46f36ef8e06bd69fab01cfa9d56ff1585b623ad3dbbb383359b1aca033f646fe2486e82ea2f2848254d0a
  • SSDEEP 768:4uLZZTUAoOSWUYZL8mo2qF/eeXK5o5TN8/nPI6EzjbZgX3iWzNdtlXSCRNqVBDZV:4uLZZTUTn2LeEoTNKA6E3b2XSWxlvW7/
  • TLSH
    T1B1231B003BE8812BF2BE4F7859F262454A7AF2633603D59A1CC4519B5713FC5DA42AFD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2