Extracted

• • Target
    b098846a39491466c8e2a66a8f938117f0497ad915a8bb59d865dfa6ca4a5f39
  • Size 45KB
  • SHA256 b098846a39491466c8e2a66a8f938117f0497ad915a8bb59d865dfa6ca4a5f39
  • MD5 c7240346ac3567de2f62398cba8d4e79
  • SHA1 c183d51feb4eb92a064e259a88aa7e904ef2f233
  • SHA512 088b003fca791846c7856442fa92e4d9abb6a9cfb22bd27a930857d511760ec5347a9adfa8dbe0e525452caa1c6a32d0117d58a67729a351ed20e4cfa19b19de
  • SSDEEP 768:MuBGJTP0BQ0UWUWHaimo2qVyLiE0yFjrdjYkk8PIuujbBgX3iQI3QPXVArsskOBE:MuBGJTPho2/LBXQBuCbuXSQlPXfsRdEx
  • TLSH
    T14B232B0037E9812BF1BE4F7869F26145867AF6733603D54A1CC441DB5B13FC69A42AEE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2