Extracted

• • Target
    80ccbda9390eb8c21a54afa0bccd8a22e54a48c92f3f33575626b7dabbc56bb2
  • Size 45KB
  • SHA256 80ccbda9390eb8c21a54afa0bccd8a22e54a48c92f3f33575626b7dabbc56bb2
  • MD5 304f79c0429fa9cffcc37549e0859bb8
  • SHA1 bbf98a929e1b72edf3b883b8ad8baafc316fbf95
  • SHA512 09f97173f4828297f9b03d5aa96bd1835e3d264aa44b6542d75e4f67c5396f015871ff49adea5111a549b77a2721dd8825873d87ecb1f3ac439e0f0e548ddf9f
  • SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qF1Nd3u40cMOPI04zjb0gXTiQLw7/j0bvsgCazBDZEx:MuLAZTnbg2m8+M3043bbXOpgCUdEx
  • TLSH
    T1D7232B003BE88127F2BE4FB89CF26145467AF6736603D64A1CC4529B5713FC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2