Extracted

• • Target
    b0fde1764ed8b887bd57fa4de9b5dc83323bfc74e076b22152da8d074c397a54
  • Size 45KB
  • SHA256 b0fde1764ed8b887bd57fa4de9b5dc83323bfc74e076b22152da8d074c397a54
  • MD5 3264f0c44a019fa8d150d5aa557d429b
  • SHA1 2622ee4eaecf5ca0f8d400256f7f22527b1d15d8
  • SHA512 626ef2ba512268526355449c06e2ba88a028dd4e5bffa28d70cc639c602fd81f99f48dfb96b374e19f069f8e47e09a774475340aa6ca2718ac02b22fe1e1bca1
  • SSDEEP 768:wuZ8pT1Uu4/cWUeT66mo2q1nLiE0yFjrdjYkk8PIuJjbIgX3is1IICB7hi7M9BDo:wuZ8pT1tc2KLBXQBupbfXSo7CrmAdMx
  • TLSH
    T1DE232B003BE98127F6BE4F7899F26141867AF1772603D54E1CC441DB5B23BC69A42AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2