Extracted

• • Target
    b0c861d0d6789cace308d68cf79b0e790065e60acffe229e8e7ef97b4c5d9d2b
  • Size 45KB
  • SHA256 b0c861d0d6789cace308d68cf79b0e790065e60acffe229e8e7ef97b4c5d9d2b
  • MD5 dcf2bcc29fa2c202a8a62c035fbb2cb5
  • SHA1 e665087f140cc258c481851b8e352f7a47307172
  • SHA512 a364c26c9dcf180c8e2922a8176cfcd1c49bca5807d82cf7e62ad82841ac97321eefffb3391745515201b390d11eb75e2ac531be6d3dc4f8118415559bd3a31c
  • SSDEEP 768:wuZ8pT1Uu4/cWUeT66mo2q1nLiE0yFjrdjYkk8PIuLjbqgX3iKw/SG6WrkPlgEPO:wuZ8pT1tc2KLBXQBufb9XSKwKCrkPFdO
  • TLSH
    T1C8231A003BE9812BF1BE4F7899F26145867AF2672603D54E1CC451DB5B23BC68643AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2