Extracted

• • Target
    b9c145cb8a2d60683b8d92222f17b11fc6fa9c353c28f589f7a3f5e85bdbf4e2
  • Size 45KB
  • SHA256 b9c145cb8a2d60683b8d92222f17b11fc6fa9c353c28f589f7a3f5e85bdbf4e2
  • MD5 6cd4f20959d8a30fd2779dea0bd5f670
  • SHA1 5c66ddd25cf53a3bc283610f41d78b72172f0ad5
  • SHA512 1b693e88d7ba03053b88a3d4bebf024512bcff6d9b6b085565204d8309520545b85569c5b78d3f228ce1dd5f9ee66398aee6588f44f5f9016fbed52e92205327
  • SSDEEP 768:UuKWgSJTwU6NkWUGnaSmo2qABw0QbKXPIKzjbcgX3ihTDEO569BUC7YYPdomBDZe:UuKWgSJTwRf2Z8K3bzXShfEc69vPdcx
  • TLSH
    T12A232A003BD9C13BF27E4FB8ACF26145857AF6633603D6496CC451DB5A23BC58A426F9
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2