Extracted

• • Target
    bd85ecd068a2f681b0f514ce5b13bc8bf8fc15b10a7d4c3bce59b3b49313e139
  • Size 45KB
  • SHA256 bd85ecd068a2f681b0f514ce5b13bc8bf8fc15b10a7d4c3bce59b3b49313e139
  • MD5 27f14923d3acde160e459ab8d8408c21
  • SHA1 39dc072760222cb055cb5d584e6f25d98ef82cd9
  • SHA512 b7b312e00b53f20a235ac2fc8f3cd4a0bc12c6c5250c82a6ab455bd277dc6f6440017c2c523e88d40d85a9491e84b29cc706961af4e427b50ba369eebf63a476
  • SSDEEP 768:wuZ8pT1Uu4/cWUeT66mo2q1Hqyx0OFUwdrxIkDPIHzjb5gX3imGvaAZlKbrBDZMx:wuZ8pT1tc26qKTNMH3bWXSnvGdMx
  • TLSH
    T189232B003BE8C12BF6BE4F7859F26145867AF6637603D54A1CC441DB5623BC68A43AFD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2