Extracted

• • Target
    b35466ea5091cc5ff54e8834c77f657a480debda7eae5557718b063bf04cddb7
  • Size 45KB
  • SHA256 b35466ea5091cc5ff54e8834c77f657a480debda7eae5557718b063bf04cddb7
  • MD5 98e67fb2044b6bfb6ffa2f87ca935413
  • SHA1 fe824eabd391167a42dfdf788fd4e3ec5192fbee
  • SHA512 10d142d92f3c7f250ff5ba8b110f90ad784f27a084a0b8687a32ad422ef10f0acd6837f59015e931029e842c22f679bc2cd73045b7979422db46eca194c93ae9
  • SSDEEP 768:kuSOpTPTCFcWUeXa6mo2qAG8V1RpYEcPIazjbzgX3iIvH1d7EW1mBDZMx:kuSOpTPOP2W8VDeEha3bsXSuH1d7dodO
  • TLSH
    T15C232B003BE9C22BF2BE5F7898F26145867AF2633603D5891CC451DB5723BC69A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2