Extracted

• • Target
    00b5fed6a2f36983e70607965e11afd690d662db47d1c9cbf4c69dd6c797a439
  • Size 45KB
  • SHA256 00b5fed6a2f36983e70607965e11afd690d662db47d1c9cbf4c69dd6c797a439
  • MD5 bd7420f075aba837dd4b78573e085b96
  • SHA1 fbfa60141a1467fd3d8a59797744499b52aa6216
  • SHA512 f6ac902f4dfeff9115ce4d39fc3f0b0875116cffd5f3d16d5d974194cef9ea108b924b02befcb3f30a2a6ab89f72cfd3f740b127126e54d787a3f9aff732974a
  • SSDEEP 768:EufspTfzcR6uWUcb+wmo2q9oozfy3CKPI0djbmgX3izaomZ/591WoBDZsx:EufspTf2g20TR01b5XS4hZldsx
  • TLSH
    T185232A0037E9812BF2BE5F78ADF26145867AF6633A03D6491CC411DB1713BC68A526FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2