Extracted

• • Target
    b88e26e8352c59d25fc024e37cf9eae4c56e0ce3001923e8885964ab8984126c
  • Size 45KB
  • SHA256 b88e26e8352c59d25fc024e37cf9eae4c56e0ce3001923e8885964ab8984126c
  • MD5 a3329eee5b66e4e546ed06b5a82ca1c0
  • SHA1 4916ddd22969852c53cc60a4e3df22b6d801f5d2
  • SHA512 b1725f7c0ea8004835f7f8d35984165348d8c46a973ddf60caeb70a837cb9711068d97883ef701836acd69f9d97d4ccaadc4e6cf8edbe1b79e94dca36e6af650
  • SSDEEP 768:cu6RaepTPYzbs8WU+Xaamo2q17xJdxrPHuPIbzjbXgo3irLHc2GfdDSAb6nK4e3v:cu6YepTPso2exR3b3bwoSrLHc2odmAOu
  • TLSH
    T1AF232B103BE8812BF2BE4FB899F26145467AF6636603D64D2CC441DB5623FC68A436FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2