Extracted

• • Target
    bfab782f9e1244583b3496c6993c47d25ec07f5f024f000d471650ebcac7d9cf
  • Size 45KB
  • SHA256 bfab782f9e1244583b3496c6993c47d25ec07f5f024f000d471650ebcac7d9cf
  • MD5 ab7068458c15a8f2edbfae725979d8c1
  • SHA1 55b2984b99d23e039174da055c4a4dfc27cb1311
  • SHA512 41bc79ad4cf1e3e917d97d64d7f8718b5a20e20675c03dd9a4d9978bf49cb14314c50ecec66904b5ca4dc5bcff20a824f61449a263e9d5caee926b5625795c0c
  • SSDEEP 768:cuR0JTPUYkEWUmjWymo2q1fLiE02FjMdjYkkmPIOzjbogX3i6lWbN7vbQCQ5CMEL:cuR0JTPjY2SL9wQPO3b/XSGYrm4GFdUx
  • TLSH
    T15B232A0037E9812BF2BE4F7869F26245867AF6732603D54D1CC451DB5723BC68A43AFA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2