Extracted

• • Target
    b0516d7846aa9ebbb1ab148b7296d73e0c6255e8ba98fc20612cb2c8dd5f8348
  • Size 45KB
  • SHA256 b0516d7846aa9ebbb1ab148b7296d73e0c6255e8ba98fc20612cb2c8dd5f8348
  • MD5 c2b9ec1c9b14e95328dd365d85af540b
  • SHA1 4c48803f227b00121ad9139f1477d91d6be6272e
  • SHA512 8624d97a417efcedf51104b61c4142b57e209caaacc1d3ab14994742f73f3a527b932c69f5327060ba2d0636d277799caa9b11888bce922359ff6e36d1d05d82
  • SSDEEP 768:ku40ZTX3uXTaWUgzW0mo2qwGeeXK5oibbb6TN8/nPI6WzjbHgX3i04Ss4aL24SB8:ku40ZTXEb2TeEqTNKA6W3bAXS0xs4aLV
  • TLSH
    T1B7233C003BE9C12BF2BE4F7899F261458A7AF5333603D55A1CC4519B5613FC68A42AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2