Extracted

• • Target
    bd07441d23fc280c03dcf05176d36f759194dcf6c2c599e692c8ebad0951394a
  • Size 45KB
  • SHA256 bd07441d23fc280c03dcf05176d36f759194dcf6c2c599e692c8ebad0951394a
  • MD5 7c2fce878caedd194d7626e06cea9ac2
  • SHA1 e62916b733c4ccde94fec2c1d5086c5522319779
  • SHA512 b400d23bf6b427be1f5a599e1f984e9b68d730d7e9bc1f970479f766b0a786f6204ce3e4f0e7db7ecbed9e136e8a74a3fb91975a523b8d41d3cd216a3edbd6d1
  • SSDEEP 768:0u1YJTHwAUgQWUaT2Wmo2q9MCOtTMtPIlzjb7gX3ic7QlGLzQtECTQSBDZ8x:0u1YJTHcw2TRvl3bEXSc7sYk2wQsd8x
  • TLSH
    T1FD232B0037E8822BF2BE5F7898F26145867AF6673603D5492CC441DB5723BC6DA426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2