Extracted

• • Target
    b549c2f7549ccf6a7b1caf2f93319079d78f95dd9dd1a06bce9afefa35eb8428
  • Size 45KB
  • SHA256 b549c2f7549ccf6a7b1caf2f93319079d78f95dd9dd1a06bce9afefa35eb8428
  • MD5 63c469c5da8e6b45551e4c250c368969
  • SHA1 c7f43298a2f226ccf89ce7de3e508c5dfce3048d
  • SHA512 c8efd67507a1ac29203aefbc7fb29507dc64d823429b014a75ec3acdd1f10a848441df77205e5b3e545a36adaa0893e077a742f49404973310427e767d4ccc2f
  • SSDEEP 768:4uBGJTP0BQ0UWUWHaimo2qVzsD/pneqPIkzjbpgX3inKvnLOSeds9BDZ4x:4uBGJTPho2QsjJeTk3bmXSnKzDedsTdq
  • TLSH
    T1FA232B0037E9822BF2BE4F789CF26145867AF6633603D5492CC4529B5613FC6DA42AFD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2