Extracted

• • Target
    babc2c02630f70e6b04c94f8ca3f67ed3ba7638594a42dfd298c3313f65528e4
  • Size 45KB
  • SHA256 babc2c02630f70e6b04c94f8ca3f67ed3ba7638594a42dfd298c3313f65528e4
  • MD5 85ec7f29e43fe114b636a1440cdaa247
  • SHA1 18567bf54424b5638bfa9bf01c4bf15612de68bc
  • SHA512 bb733dfbfa8e06ec27518fdb79000518b5955701e4332c7bfb2fca85131883d75cf406f4e45b4137e3b16ad182f15244e5d04cc9f192efda1dd8ab1bfab61734
  • SSDEEP 768:MuBGJTP0BQ0UWUWHaimo2qVRL5P0NFUFdJYkk8PICzjb0gX3i4+Klr+MOsH+VuMV:MuBGJTPho2QLsm2BC3bbXSV6eelDdEx
  • TLSH
    T17A231A0037E9812BF2BE4F78A9F25145867AF6632603D54A1CC451DB5B23FC6CA43AF9
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2