Extracted

• • Target
    bdc5673765123cee83279ca866dc39f6db3c4cb406764078def52403fcf68771
  • Size 45KB
  • SHA256 bdc5673765123cee83279ca866dc39f6db3c4cb406764078def52403fcf68771
  • MD5 85952c60ae4c4bc397c14b19dec80379
  • SHA1 51697bdcdc62773188bd7f9afd748f4b08689885
  • SHA512 d4ee6eb743222ec05c33ebf1991d5ca53fbf032751f9953c5411ce94e29bf8964ec0ec713099cfc116c2759228c0061966c9a66eaed4e0674444a0ea1de9995b
  • SSDEEP 768:RuxkJTVmU5EkWUGMKSmo2q1lHUttXAPIMzjbngX3F4ALshkzZ/sJKOBDZcx:RuxkJTgip2c0rXlM3bgX10hkz9Wpdcx
  • TLSH
    T1B3233C103BE9C12BF2BE4F74A8F26105867AF2637603D64A1CC452DB5613FC68A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2