Extracted

• • Target
    bb8babf2523078bf9c52c0dba8c341e59da55d7490d4c0d6dee2f44e6f46db37
  • Size 45KB
  • SHA256 bb8babf2523078bf9c52c0dba8c341e59da55d7490d4c0d6dee2f44e6f46db37
  • MD5 e852a02724c48220d38f35f8deb8906f
  • SHA1 05fede8d120b1f4c31b62a115a9a497886f6664d
  • SHA512 595759723fdcfa3d22ac8af9a0f4ba06f4893cd533067ec4f803fbf1a3f719ad14acd09bee192fbdc2114c33ec24985c621a879ed14b737b5af9c7c6b0d8002d
  • SSDEEP 768:EulCJTHESwgWUK3aGmo2q90ZbtDMQPI8LjbAgX3iS9BKsLN41jVBDZsx:EulCJTHl42lJk8fbnXSS9BKsLC1fdsx
  • TLSH
    T17B232A0037E8822BF2BE5B78ADF26145867AF5673603D54E1CC4419B5623FC68A427FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2