Extracted

• • Target
    0bbb867aae046e14fb4905a6e259842d3eff39ea42a86f0ebe5f7ad2d5f93301
  • Size 45KB
  • SHA256 0bbb867aae046e14fb4905a6e259842d3eff39ea42a86f0ebe5f7ad2d5f93301
  • MD5 aadfe65761bb70e0bcb8f4cc748f37d9
  • SHA1 77cbf9ccd658e0deaec9e5810b3debdc0de24e04
  • SHA512 0dedc6e3ab631a96f9880a26493039555358dc194150a818b9765a1940e9a76c494a02ead36da8098f7b107ecc98a151e0eafda2563bfb8a90e1016b02f206c4
  • SSDEEP 768:UuKWgSJTwU6NkWUGnaSmo2qAQBz3QKx7PIUcjb7gX3i0TOlJbRPeMgGBDZcx:UuKWgSJTwRf2gV0UsbEXS0TYRVdcx
  • TLSH
    T180230B003BE9C12AF2BE4FB8ACF26145867AF6633603D5492CC451DB5623FC686426ED
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2