Extracted

• • Target
    bd3e90376d618dedf2b7503b56b2007330366c2bd899ceac2ef0de8a508080c1
  • Size 45KB
  • SHA256 bd3e90376d618dedf2b7503b56b2007330366c2bd899ceac2ef0de8a508080c1
  • MD5 709e76a6c5c550cfafcbbe3278f63219
  • SHA1 4814f20142ec7077a0f6cec7b676a9ddcff31952
  • SHA512 1183e1a21d5d89f8774661efa8abc51cd800c0c321252d7f7ea7538910ebf68093ae851a856abac8b9f7f3f4eae0c527db9c5f4b21cf38dbdaea4d8e5c1bb1a9
  • SSDEEP 768:0u1YJTHwAUgQWUaT2Wmo2q9sZoyTM4PIXNjbsgX3iubNU9gm0HC3JUaTcBDZ8x:0u1YJTHcw2dh0XFbjXSupU97kz06d8x
  • TLSH
    T184231B0037E8822BF2BE4F78ADF26145867AF5673A03D58D1C84419B5623FC6CA426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2