Extracted

• • Target
    bf9c5fc813c30c9e0508b8d4da80b0ad480c2c04b093ee36f7a1bf654a719005
  • Size 45KB
  • SHA256 bf9c5fc813c30c9e0508b8d4da80b0ad480c2c04b093ee36f7a1bf654a719005
  • MD5 f0c8defab52ee4605ac81a560799ebb2
  • SHA1 1fe2602b5da0ac952ecbd8732b048a6138260510
  • SHA512 8b0ac2a120439e7e33362b1c25995b40a2799806af60a9862a293b9b1e5dd8524a58227043e2adb9796ba4cd03c3c9149eab6bf8834df709db68c5f775d98571
  • SSDEEP 768:cuqb5TrIGuCWUoKXMmo2qQElsNoPEaMPIcSjb3gX3i37UyL8vFiZ5JBDZUx:cuqb5TrhG2gsuEaxc+bQXS334vaXdUx
  • TLSH
    T17C232B003BE8812BF2BE8F786CF26245467AF5B36603D5891CC4519B4713FC6DA526FA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2