Extracted

• • Target
    bcda2e1d010d6b4dc5167635815c3b51d0465836e768e4716ca9456829f78bc3
  • Size 45KB
  • SHA256 bcda2e1d010d6b4dc5167635815c3b51d0465836e768e4716ca9456829f78bc3
  • MD5 48a7e5d966771ee043c54e2f7ea4fcee
  • SHA1 c9adaf1ba282c3b9a12a5a1468f255baa927cd74
  • SHA512 b1bc4334d3ae7f18ebfb1256e39bda9ad1cf32a74e726d6d69f33f3683e160765c267d3d8037b7082c5799dd09349b72ca8ff76b8ce15cbb00d21d5c74c1a925
  • SSDEEP 768:0uAVhJTDEQAQWUaDyzWmo2q7DCOtTMtPIBzjbPgX3iHGdeL8mBDZ8x:0ushJTDXgH2SRvB3b4XSmd/od8x
  • TLSH
    T183232B0037E8C22BF2BE4F78A9F26145867AF6633603D54D1CC451DA5713BC29A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2