Extracted

• • Target
    bbb6525cbeff1e5b8a88a9981d37e3f6dd6d0a5a0f502d49b2a23a0471a31488
  • Size 45KB
  • SHA256 bbb6525cbeff1e5b8a88a9981d37e3f6dd6d0a5a0f502d49b2a23a0471a31488
  • MD5 855d4d284604c73154663212618ffe14
  • SHA1 79258d97791e6f7e16a590b0245b0c277e48fc12
  • SHA512 6239428137d725c66aa2dcb9040451fe6be051d13aec1303f8407fd910fc010ef8a2bcc9bb826cb70a6d68506bc58c51c7d432447a6e1bc958cc9d823b942239
  • SSDEEP 768:0uPrpT/LGKeWUszuAmo2q9Xozfy3CKPItyjbVgX3iNopVwBDZ8x:0uPrpT/qY2ZTRtebyXSOfmd8x
  • TLSH
    T11D232B003BE9C12BF2BE4B789DF26145867AF5733A03D64A1CC411DB5713BC69A426FA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2