Extracted

• • Target
    bfe4f66b2ef72fa5e266d5c50c145fa96ec4c8f004cfc571fdbe2681446514ba
  • Size 45KB
  • SHA256 bfe4f66b2ef72fa5e266d5c50c145fa96ec4c8f004cfc571fdbe2681446514ba
  • MD5 c734abbb3298b87ee8c73418933384a0
  • SHA1 84138eec8569363c97ad8f05f00d329c7fc00dde
  • SHA512 887c785c17ea1183a1207bc1810015bbe34f8969aaca26eada40134344eb2d2148a340803755f8a549d7b6e71b17695b99c87fc332d15e252d7421752b6edf38
  • SSDEEP 768:4uLZZTUAoOSWUYZL8mo2qFIZTohEaSPI0zjbLgX3iN7dA3XAHrBDZbx:4uLZZTUTn2F4Ea703b0XSfwadbx
  • TLSH
    T1B8231A003BE88227F2BE5F7859F26145467AF2B37603D58D1CC4129B5B13BC69A42AF9
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2