Extracted

• • Target
    b040ab2abbc320d5e67c7ab1865ffeb636ecfaf1fb857beb5e1cb6d87a868051
  • Size 45KB
  • SHA256 b040ab2abbc320d5e67c7ab1865ffeb636ecfaf1fb857beb5e1cb6d87a868051
  • MD5 7c4c1f4532051e28d7ba7a5c811057e5
  • SHA1 a784285a5976def0e311e57c9f24df950c3804ed
  • SHA512 7112c8a94ee806b076aef7921e2bd0987a060043a6018049b86eb8ba57da4cc4127828880d704fe2c6e37eb31a5c000f5cd61fbce6e9ea56b84d441e21fb45ee
  • SSDEEP 768:EulCJTHESwgWUK3aGmo2q9tCSwTMjPIuIjbngX3ihD98RFZgehtOnBDZsx:EulCJTHl42ag1ugbgXST8T6otOBdsx
  • TLSH
    T194232B0037E8C22BF2BE4B78A9F26245867AF6673603D58D1CC451DB5613FC68A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2