Extracted

• • Target
    bd9dbaeb97273a6174e4a7da1f9e706a8fb13dcfa9a66acc55ccb767bdbf59e4
  • Size 45KB
  • SHA256 bd9dbaeb97273a6174e4a7da1f9e706a8fb13dcfa9a66acc55ccb767bdbf59e4
  • MD5 55216644b079aaf52f646884a84291a1
  • SHA1 3b181f36f4e2f038d222667ab9ecd53a126764e1
  • SHA512 3fb74f145152aab91a024f11c7b54a5856124f68b5fd9fd3c5009bdc0d89315cf13b13bc266d936283377232da509f5862cd6fe9a436a17a629e7073f4769ea1
  • SSDEEP 768:MuBGJTP0BQ0UWUWHaimo2qVQ0e3+Kv18iZPIezjbRgo3iqJBSPqFx26DPIWBDZEx:MuBGJTPho2n3T6iWe3beoSqjiqFTRdEx
  • TLSH
    T11F232A003BE8812BF2BE4F78A8F26145867AF6676603D5491CC451DB5B13FC68A43AFD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2