Extracted

• • Target
    b336bde818d02348471bfe9f6f364eec4c700d0e1ee5d7635befa3a5bc3a298c
  • Size 45KB
  • SHA256 b336bde818d02348471bfe9f6f364eec4c700d0e1ee5d7635befa3a5bc3a298c
  • MD5 80d15a2ccc2bf58e0df95341ab8cf17a
  • SHA1 57ae177713f713df488d8a8248d619a176690fdf
  • SHA512 f70b3cf069266141df76d06f570044cafcf4fdece4b6aaea5c69e171944412fb5de2ce451267cd61f517dc748332f2be1879532b6f089c08f520517aef736912
  • SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFEfBohEa+PIvxjbegX3i79NKHMU1DNtBDZEx:MuLAZTnbg2Z4EaHvhbhXS79cHMUhldEx
  • TLSH
    T194230A003BE8C12BF2BE4F78A9F26145867AF6636603D58D1CC411DB5613FC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2