Extracted

• • Target
    bbd96e883d892568b4002140eaa6fc89b5b29921e831015123c77aa714c66b08
  • Size 45KB
  • SHA256 bbd96e883d892568b4002140eaa6fc89b5b29921e831015123c77aa714c66b08
  • MD5 e1df3dddf7d850a750b633b4c171f159
  • SHA1 60f3ce80e892ae27ca95c9bebdfe3b0e4556bc10
  • SHA512 e62546ab704ce8cc4ba76ccf7df881e6e9295e921c4b8369142181bfaf9a175a968dab804d68227a38817fcc4dc49e8697a1530b596902a2951f4bd1cf6abd4f
  • SSDEEP 768:0u2vpTD4U2ieWUsqfAmo2qjwozHy3CKPI2IjbrRgX3ikhcSDo8P1cfobZJ0ZBDZ+:0u2vpTDe+2urR2gbCXSRSmHd8x
  • TLSH
    T129231A003BE9C127F2BE5B789DF26105867AF6633A03D5491CC4119B5723BC68A52AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2