Extracted

• • Target
    bbcb4cfff40b78dbb54261a4e48301382c4f3025d110903d15f22f4b455acb02
  • Size 45KB
  • SHA256 bbcb4cfff40b78dbb54261a4e48301382c4f3025d110903d15f22f4b455acb02
  • MD5 62ce3a64f788374d0f01f67e62d6c770
  • SHA1 1f7e5395b0006efe9a8467f5162f5007b69501fb
  • SHA512 ebfaece483b6236e6d316d3d6698783738848e24bb21c899def1d613a91cedd8c8138612cc631ad2a96aed806c8c8cdacee5a5e5738d81d5b8b0d9451a36aed7
  • SSDEEP 768:EufspTfzcR6uWUcb+wmo2q97iD8yfzuOPIlzjb1gXKirZZTFwuM5zVwk0kc9Ytiy:EufspTf2g22iAJ3l3bSXzrWF5W1VFdsx
  • TLSH
    T1C02319003BE8812BF2BF5F78A9F26145867AF2632603D6491CC451DB5723FC68A526FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2