Extracted

• • Target
    b98ca13b0f09c4dd02b7f22a39cf68c7c23dcd39a8da1b5242e3ad95924a88e2
  • Size 45KB
  • SHA256 b98ca13b0f09c4dd02b7f22a39cf68c7c23dcd39a8da1b5242e3ad95924a88e2
  • MD5 c16a7f436fe2ee680b3988349017f3f9
  • SHA1 a8e60b08755fd389520819438527af6b69b2fd94
  • SHA512 45fa58976990b30bff480cb3ded45dff9b6b071ead3e30a5370a06f8b79dcbfdf95c0b6f234facda8834c35ccae031b1131fbc0fb22493bf480dd9e4fcb7f884
  • SSDEEP 768:cuR0JTPUYkEWUmjWymo2q1fLiE0yFjrdjYkk8PIuIjbngX3i3nVQVBLBDZUx:cuR0JTPjY2SLBXQBugbgXSlUHdUx
  • TLSH
    T1CC231A0037E9812BF2BE4F7868F26145867AF6732603D64E1CC451DB5A23BC696436FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2