Extracted

• • Target
    b1c90fe3c668fdb885a8c3351616ca08313ed21ab95a2142cb3764ae8f6018a7
  • Size 45KB
  • SHA256 b1c90fe3c668fdb885a8c3351616ca08313ed21ab95a2142cb3764ae8f6018a7
  • MD5 f599b4fd892ed5f3d6f15da282e469dc
  • SHA1 c003e45d30284566bbcbc3534c02a530b2457e8c
  • SHA512 0db5b7cc0e9c0f5a98942cffd38fa962a9b83e70f7f8047add95a508c7ed4ae01d3ba8f13fa9d1cf4564befc4a33f0149e1e62e98bab1080a28422c85d9099ad
  • SSDEEP 768:cuR0JTPUYkEWUmjWymo2q1wpt0CCM+d4CvS8PIkmjbBgX3i5SyhUm38+zBDZUx:cuR0JTPjY2p/CFWBkKbuXSoyh4mdUx
  • TLSH
    T13A231B0037E9812BF2BE4F7469F26241867AF6736603D64A1C8451DB5B23FC68A436FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2