Extracted

• • Target
    bd409c905c28defbca9bf9bf66df0632159259ffda3ec9340d5f4040b8491517
  • Size 45KB
  • SHA256 bd409c905c28defbca9bf9bf66df0632159259ffda3ec9340d5f4040b8491517
  • MD5 87500838ed790b11a9f87ef824b9e4cb
  • SHA1 ef85b71d074f9994f2f9b83940cb5a14f2a582e0
  • SHA512 4d7d396b5f2a8c2b19c1da9dcdb91535b9dae4e8f59d37b51c7291c6d48799b754b08e65ef41331c875f7832feb9f123378da441c0c96033a2435cbc40a100b3
  • SSDEEP 768:8uUIpT4vvofWWUEXb+Imo2q4UITnyfaaPI6zjb3gX3iF2Koyqs1UF6hxNIBDZ0x:8uUIpT4vAj2wEh63bQXSF2Uqm46hxNuU
  • TLSH
    T15B233B003BE9C12BF2BE5F7898F26145467AF6633A03D58D1CC4119B1623FC19A52AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2