Extracted

• • Target
    b9b1fc36b1172a49ee0f1b8d112b7f584d0b87be565a834dfa535a39b4650581
  • Size 45KB
  • SHA256 b9b1fc36b1172a49ee0f1b8d112b7f584d0b87be565a834dfa535a39b4650581
  • MD5 e3815b82e4230cc8bf4f860894213961
  • SHA1 2b6ece3eb66c7083133a1e0f4c84ca92e0ea341c
  • SHA512 8523aecae4b65fb4d352286df656163667634461ae3451f0917eb9a550ba0c9a069d536b94159100bdf77756ca6d13ba2db393a572d01cd9b0ac6138243df56b
  • SSDEEP 768:5uSy6pTpwrSWWUE3/WImo2qNrITnyfaaPIVzjbkgX3iiMU+4CgewW987BDZ0x:5uSy6pTpoo2oEhV3brXSiE4d0x
  • TLSH
    T156232A003BE9C127F2BF4F7899F26105467AF6633A03D6491CC451DB5723FC68A52AEA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2