Extracted

• • Target
    bd0e5b93c4dfcb637cb8ca25320addf80fb21c3bcea741d77acf5445e7e56285
  • Size 45KB
  • SHA256 bd0e5b93c4dfcb637cb8ca25320addf80fb21c3bcea741d77acf5445e7e56285
  • MD5 c0bcefe876147f32f9a5ca732fd48f21
  • SHA1 6a6c8a05d3adbfa79bc9d7ea5c2f16c883e6f7ea
  • SHA512 77b297685bf9b66478fb83739a8f75fa3c5b9d40e7db8387c7ec13db7154728465b699a6c381216290f639a9ee44d2b57f8b675f65b4c381e887bec310c187a0
  • SSDEEP 768:cu7m/5THrq+CWUoDuMmo2qFKNd3u40cMOPI08zjbggXriZVvo9PifdrL0dBDZUx:cu7e5TH2A2R8+M3083bHXmZVvotilSdW
  • TLSH
    T159232B003BE88127F2BE5F7898F26245867AF2B33503D58A1CC4519B5A13FC6D6526FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2