Extracted

• • Target
    b567386c838206186fd00e33c51b930c80574756fb3a273dfe1e8198a6f1c047
  • Size 45KB
  • SHA256 b567386c838206186fd00e33c51b930c80574756fb3a273dfe1e8198a6f1c047
  • MD5 5050724f00759b39701627452e9f5f6b
  • SHA1 ab16a14f7277410572e98636cd20f6737b668c40
  • SHA512 c78809acbeb976a7ff55d859061fe266881ccfd7959b9ef20b224a5b48823f9d06e99bed2d4b7ab284d41d24c13fa314a606d2cb7525bf188d6e1551214c3747
  • SSDEEP 768:UuKWgSJTwU6NkWUGnaSmo2qAebT0GYjHuPIpzjbKgXBiw0YoO5V2z6v2+BDZcx:UuKWgSJTwRf2us/3p3bdXQw35hv5dcx
  • TLSH
    T1D6231A003BE9852BF2BE4FB4ACF26145467AF2637603D5491CC451DB5623FC68A42AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2