Extracted

• • Target
    bbb413926ea0c9c2d4b86d34fd16b4ec4a33074bce59a2a3e4a7baee50aefe71
  • Size 45KB
  • SHA256 bbb413926ea0c9c2d4b86d34fd16b4ec4a33074bce59a2a3e4a7baee50aefe71
  • MD5 4e876bf71eb8c6d9283adf1dc52ed60e
  • SHA1 645da3c3e7e533e66f7f40432ce47a2473012c7c
  • SHA512 3554300cbfabf10b1ca460b085e5c53803e1eb43b3a1fe0a7e6150c4f51d358c3fddc714cc7165b1a1593f1d72fe386899f03e52bbc6f67bd5305143195f5a01
  • SSDEEP 768:0uPrpT/LGKeWUszuAmo2q9i9wa0y/zFOPIuzjbdg03iJTkuE3Rd8oY7pBDZ8x:0uPrpT/qY2/Cdi3u3bK0SJTkuqRGoYzM
  • TLSH
    T1FF232A003BE8C12BF2BE8F7899F26145467AF6633603D64A1CC4519B5713BC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2