Extracted

• • Target
    bc06812db81ffc43b1fc118c6c7413f9cf35889e62d0cf4b204fa502820850d7
  • Size 45KB
  • SHA256 bc06812db81ffc43b1fc118c6c7413f9cf35889e62d0cf4b204fa502820850d7
  • MD5 9fad9cac1cb8d1d1812eaf926826f1f1
  • SHA1 e7cfd993cd41c359101ca26702eb3dbbb2b37d1c
  • SHA512 239d635e4f352eb2e77e20255c3ff0dc7a6ffe5c7373855c336582db4912bce434f4b7a88fa4cc38c6220fa4939543c2242b442aed63acabb9b150a01680d78d
  • SSDEEP 768:0u2vpTD4U2ieWUsqfAmo2qjT9Y6kq/zNOPIyzjbjg2v3ie4eThv68I+bTdBDZ8x:0u2vpTDe+2oa9C3y3b8wSe4ihbTzd8x
  • TLSH
    T174232B003BE8C12BF2BE4F7899F26145867AF6632603D6491CC451DB1723FC29A526FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2