Extracted

• • Target
    bc4263fd28fc63af6dc77cdb7886b1d1d22dfee6cd8017b0e342495b074f497f
  • Size 45KB
  • SHA256 bc4263fd28fc63af6dc77cdb7886b1d1d22dfee6cd8017b0e342495b074f497f
  • MD5 a692352443534723502650ccfd826fdf
  • SHA1 e28bd8d706a9b0e39c6d1b3221a8b22dcc2b9d3d
  • SHA512 a89e91fd61dadec2d55420ffe8b455164f7b406174af0cc5227e3e5ec998344dbd2932b154ad450009e3ebe1d4e31860f219a70a485240ff8dc98c095974e855
  • SSDEEP 768:EulCJTHESwgWUK3aGmo2q9cx1HJhOPIcozjbCgR3igPvhxtHjdlEBDZsx:EulCJTHl42tFj3co3blRSmvNDdlydsx
  • TLSH
    T1BB231A0037D9822BF2BE4B78ACF26105867EE5633603E59A1CC451DB5713FC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2