Extracted

• • Target
    b0807844fbe5de16140c8883dee898d3b59b8e49ea22c42d2b02a051f0772106
  • Size 45KB
  • SHA256 b0807844fbe5de16140c8883dee898d3b59b8e49ea22c42d2b02a051f0772106
  • MD5 48bac24dac629e6119c6367360ee4bc4
  • SHA1 330285c741edda1e64f5242187d4d03daf0144c8
  • SHA512 1754e487246876c7ff6e3abbad9415c7417199519a52864a1132cee6d868e4fc251cf4815381694d2f93504ba4afbe8d36dd429abacfccb748361b19fac39853
  • SSDEEP 768:EufspTfzcR6uWUcb+wmo2q94O5QPCBjPSNjPI/zjb8gX3iVtec9ISYPBDZsx:EufspTf2g2hO5sMSK/3bTXSVgqidsx
  • TLSH
    T146232A0037E8812BF2BE5F78A8F26145467AF6633603D54A2CC452DB5713FC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2