Extracted

• • Target
    0f00a17597005a1acd554c7eb620de9f1b4374c6e23b5ff589bfb915e042f763
  • Size 45KB
  • SHA256 0f00a17597005a1acd554c7eb620de9f1b4374c6e23b5ff589bfb915e042f763
  • MD5 15614adeefd33de25eabad8f5b319de4
  • SHA1 bdc1cb7ebd3ae0c05ed8971f47a6bbbf12d2915e
  • SHA512 f8180873209eecd873b6aa3dd26873af9cf0b9b1b56137e67dd1001d2dd7d0dd0d9b0a02166083250ca98016865f99f2ce81618cdbb088541842fd2485625dd0
  • SSDEEP 768:4uBfJTMUyYUWUWBDimo2qVL0y3NPAIeiZPI2zjbogH3iJDZuw0XL71BDZbx:4uBfJTMpv2m3V8iW23b/HSBZP0fbdbx
  • TLSH
    T1AF232B003BE9C12BF2BE4F7498F26245867AF6632603D5491CC451DB1B13BC69643AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2