Extracted

• • Target
    b522a3d94a1d7ccc47a9c2360e4dd49a2d00b448bf3f9a576e67b0cc16dfa141
  • Size 45KB
  • SHA256 b522a3d94a1d7ccc47a9c2360e4dd49a2d00b448bf3f9a576e67b0cc16dfa141
  • MD5 2faa939e4aa5def08614e44f0a0d85fd
  • SHA1 af8a7dbe7efd87e17387bae8d3d9bf89a51857ce
  • SHA512 1b0825359d8b0b20b20f6d907d12abdc809047ea89b738e09328b5d0431cf2297e1d530e2ceeb4c35edf5b3c77ea1cdc2933a2b90c6dc661fdba65ae66a6cdc7
  • SSDEEP 768:cu7m/5THrq+CWUoDuMmo2qF4ZTohEaSPIKzjbhgX3iC49/xxS6/bwzUnzuDcBDZW:cu7e5TH2A214Ea7K3bOXSC49/Xx/bqL5
  • TLSH
    T135231A003BE8822BF2BE4F789DF26145867AF5B32603D5491CC452DB5713FC69A426FA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2