Extracted

• • Target
    ba92997e4b59b055f8cbde2d70205abfd5ea521e7a3d5506f52c15e57442fcc5
  • Size 45KB
  • SHA256 ba92997e4b59b055f8cbde2d70205abfd5ea521e7a3d5506f52c15e57442fcc5
  • MD5 00ce1569fe66cb3e1392ea791800c6b2
  • SHA1 c7ff1dd06c4fa0ba8d25e8923624609a4cbfc392
  • SHA512 d59aff9c9d6ed4baa1dd498ebb0d7c1405418b2e91a34369a5a2160c69a671cf26e564167e36d14380c4d4b5277496c278f90d8390d2a0928f9b0030418428e2
  • SSDEEP 768:cu6RaepTPYzbs8WU+Xaamo2q1ebqpG3jHuPIhzjbGgXLiAlLguccBDZUx:cu6YepTPso2jsM3h3bZXGypc6dUx
  • TLSH
    T124231A003BE9822BF2BE4F78A8F26145467AF6632603D64D1CC452DB5613FC6DA426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2