Extracted

• • Target
    0b0c05edcfb18bced5ee8adcc4599409bb9d575e1d87a63e655327f54cb5350c
  • Size 45KB
  • SHA256 0b0c05edcfb18bced5ee8adcc4599409bb9d575e1d87a63e655327f54cb5350c
  • MD5 d0877220bed7cf4b48599c587cc617bd
  • SHA1 5a0b950cb9d447b3eff3dfd9f7e6ac00480e9a76
  • SHA512 569b9586352c36da2f3ecf1d9f744fd68338258cbb1db0c02448e0ca60e3083b326c7461a979606405c69151c1fb557f882ae590e4f306c6631c4f9035f50541
  • SSDEEP 768:cu7m/5THrq+CWUoDuMmo2qFFeeXKSocbbbQtN8/nPI6kzjbdgX3ijCDZK/ZdEyYr:cu7e5TH2A2deH2tNKA6k3bKXSeD0/ZaT
  • TLSH
    T12E231B003BE8C12BF27F4F78A9F26145867AF1632603D59A1CC4519B5723FC68A526FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2