Extracted

• • Target
    0c15013478e071f8c9988eb78c000ed3d905a3ea9afab3b05c62adfed819f773
  • Size 45KB
  • SHA256 0c15013478e071f8c9988eb78c000ed3d905a3ea9afab3b05c62adfed819f773
  • MD5 bc39d154e20de2de14c1c70a277d9625
  • SHA1 ecaec709449de73067533dfe5b322e19cbfd4bb7
  • SHA512 1ec0a305351fa505ecc276d9d633af4c12fb6ff45a365b2d181a14c441c2fefb84640833145297ae36155f63a5bf2e4aa09beb4d492bb85a61fc1d46fb5eee99
  • SSDEEP 768:8uuSpTg7GBoWUSH6+mo2qYlCSwTMSPI5SjbDgX3ilS9HPbX0icjR+myLnBDZ0x:8uuSpTgyf2dgG5+bcXSlS9vbki4R4LBU
  • TLSH
    T155232A0037E8812BE2BE4FB8ADF26145867AF5633603D54D2CC4519B5623FC6CA526FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2