Extracted

• • Target
    bcd565cb4c5ffeb564678c7d9c91f890c9b35c049f4375ffccc40f54b175800b
  • Size 45KB
  • SHA256 bcd565cb4c5ffeb564678c7d9c91f890c9b35c049f4375ffccc40f54b175800b
  • MD5 b46fa10fdbdbe04a4b404a4f6c031a00
  • SHA1 3d017c1bd3af943a0894822ea9ee97e3a13fd7b8
  • SHA512 df88734ba7b3acad2e2c79a8f93f56acffef6daa8115b559aef530dbe52edc51459213ba7b7fe72dd9967b46d5714edc351c8e0f2bafbacf0675c7e783ded84c
  • SSDEEP 768:5udApTNctooWUS7C+mo2qtSCSwTMSPI5sjbBgX3iAg2dCszSBDZ0x:5udApTNmU2lgG5cbuXScyd0x
  • TLSH
    T17B232B003BE8812BF2BE5F78A8F26145867AF6633603D54D2CC451DB5623BC69A436FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2