Extracted

• • Target
    b23dd7ebecf78a3e2cf674d3a551656ef04e9b8d9fa765899b7f864f3d135885
  • Size 45KB
  • SHA256 b23dd7ebecf78a3e2cf674d3a551656ef04e9b8d9fa765899b7f864f3d135885
  • MD5 b9be3430d1c1b3a259dc53b3ba6902e4
  • SHA1 d03dcbcef96966abf180d6192c0e2be2705fa705
  • SHA512 de8f02265128a93988833f16a9ecf140653b763f458ebc2888ad09d4b8ef197f7e5e7720b6be8402d3f857aab4f24d7d6965dcdef0f62866e11c09deaeb44111
  • SSDEEP 768:0u1YJTHwAUgQWUaT2Wmo2q9ZRzMwnOPIZzjbQgX3iznowjaeLJdQG9BDZ8x:0u1YJTHcw2SA+3Z3bXXS0wjdQSd8x
  • TLSH
    T120231A003BE8812BF1BE5F7899F26145867AF6673603E58D1CC441DB5613FC68A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2