Extracted

• • Target
    b0f419a400e0d0a6df23dfae413c3f72615647457f8d967898c923da953801a2
  • Size 45KB
  • SHA256 b0f419a400e0d0a6df23dfae413c3f72615647457f8d967898c923da953801a2
  • MD5 72f8cdf17b05c0301e590149237fe07d
  • SHA1 cdcf1408114039122348e4ee00ff88bdbf72d43f
  • SHA512 e34622ff21bad0c0db5433d94367bcd3a2c9468701d191d3fcde3d32bbda600c081da7750d44841d0d18d6f3dca387f91068354d1f71bafecb449a5198edf4e6
  • SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFMSAFcKoabbb4ZhM/RPIAEzjbagX3i22rfTewGtnBDw:MuLAZTnbg2vSAvQZh6OAE3bNXSlGbdEx
  • TLSH
    T1D8231B003BE8C12BF2BF4FB869F26245867AE6632603D55E1CC4519B5713FC6C6426FA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2