Extracted

• • Target
    b140a103f54219058d73554ba90bf0e7caa67efd9304cba484d7491bc497aadc
  • Size 45KB
  • SHA256 b140a103f54219058d73554ba90bf0e7caa67efd9304cba484d7491bc497aadc
  • MD5 c5a6bfab3a5a4cb8ccc393420db39b31
  • SHA1 b4bb4b62d7adaf5746312e40b3ad248b449d022d
  • SHA512 9d3e0490788d4e95ae58acc2c51f137cb989a21bf6679a64091e933f6e387dd0ae712803634bceaba26521432582ffd33b163ac77788ccd6b46a892e93e28513
  • SSDEEP 768:EulCJTHESwgWUK3aGmo2q9hCHyTtpPIEzjbzgX3i4x8kzULkdkAQ8l89kBDZsx:EulCJTHl422nQE3bsXSCmkdkHiVdsx
  • TLSH
    T151232A003BE8C12BF2BE4F78A9F26145867AF6633A03D58D1CC441DB5613BC69A526FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2