Extracted

• • Target
    b91966ad03c0b6fb4c811477df70acbc4a14e72b7322aaf9436c01b573421fed
  • Size 45KB
  • SHA256 b91966ad03c0b6fb4c811477df70acbc4a14e72b7322aaf9436c01b573421fed
  • MD5 c706727bffc9e1713dd33d7a45eb9580
  • SHA1 ba08145e0b3974a1b938f3c2de0fbaa308f756e3
  • SHA512 05a472533d2979e8784a866a639687b31c1bae96ffe0c2bd8dc581ebd58f237f54f71d78e3470dd8323eeb3ea55d705c514626ed8e279e67752558dbeb5972ec
  • SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFPJXo5EayPI2zjbygX3ipFHxSpgLpgNmid1HoBDZEx:MuLAZTnbg2KQEab23b1XSp4u+HOdEx
  • TLSH
    T1DC232B003BE8812BF2BE5F78ADF25105867AF5637603D55A2CC402D75B13BC6DA426FA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2