Extracted

• • Target
    bad6bd15686f23ede298a0098b2f29c8eeec1d8af56da83c9d1f38465b3bea28
  • Size 45KB
  • SHA256 bad6bd15686f23ede298a0098b2f29c8eeec1d8af56da83c9d1f38465b3bea28
  • MD5 08841e90eff7ffa115bd5ec52d1c9e33
  • SHA1 9b2d71909cf1a0a2606eab602736a77c71e1712b
  • SHA512 dc7bbcfa88013c7092ddeb870d2ffed5fe4408910898b1f6a798b0292a0e0b85fb906341d71f482469662ab6adadbb95e8dac83ee28bf4da2a13824c51be2210
  • SSDEEP 768:UuKWgSJTwU6NkWUGnaSmo2qAvT9Qpm9PIhzjbvgX3iEXrDqKwKA5BDZcx:UuKWgSJTwRf2hQh3bYXSaqKwBndcx
  • TLSH
    T184230A003BE9C137F2BE4F78ADF26145867AF6632603D64D2CC4519B5623BC686426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2