Extracted

• • Target
    bba40a0b24d1cb21e832d946aa958264fc5e9121211d3528fa74f48d1b260545
  • Size 45KB
  • SHA256 bba40a0b24d1cb21e832d946aa958264fc5e9121211d3528fa74f48d1b260545
  • MD5 420106dcb11ebff0407a1a56de06d3e3
  • SHA1 cf8848f967c607d9c6b6643214384874629e200a
  • SHA512 32b135f3a5f7346a03808dcac329ee349b691368de01c1e141bec8323ec769216f917ccd2ba4b7c51bf511083d55aa0b4322e29dbd243b23f6a52bd2c968ac81
  • SSDEEP 768:EufspTfzcR6uWUcb+wmo2q9wQ7PivEPI34jbxgX3i/5jborv7u32fSadBDZsx:EufspTf2g2kbk3wb+XS/5jY7uQDdsx
  • TLSH
    T1FF234B003BE8C12BF2BE5F789DF26145467AF6633A03D64A1CC4119B5713BC68A526FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2