Extracted

• • Target
    b89e5d19cbc7e3b707af5caeceeb5a03e9b56ec70dc4dc78ccb7140be1444a28
  • Size 45KB
  • SHA256 b89e5d19cbc7e3b707af5caeceeb5a03e9b56ec70dc4dc78ccb7140be1444a28
  • MD5 c42681866eddf596d2016af6814ec209
  • SHA1 f4a63041acf6dba088b9aa05ac433626a0f251f3
  • SHA512 b607c4be06e92e6e6118befadf0a2b9187a6e43bef5e367df613947213a62bcf16da48c16e1a99e04687b8927778f72c98710afb19fdd56e57c121cfbbd132f5
  • SSDEEP 768:0u1YJTHwAUgQWUaT2Wmo2q9m6R8aI3OPIOzjbcgd3iuk0Ibkjf16POhKBDZ8x:0u1YJTHcw2Z+FO3O3bzdS7lkjN6fd8x
  • TLSH
    T1CD231B0037E8822BF2BE4F789CF26245467AF6673603D64E1CC4519B5613FC69A42AFD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2