Extracted

• • Target
    0b4d7eb9b8b2443bb3e863a313ab495f534583879c2a4bc1440082b39519c28c
  • Size 45KB
  • SHA256 0b4d7eb9b8b2443bb3e863a313ab495f534583879c2a4bc1440082b39519c28c
  • MD5 7cc7a040d4ba86f8ac7a9aac05ace042
  • SHA1 f52401319877918f308b44eea0a98f7bcbf232a8
  • SHA512 72cfae74f11306537a9d7ed3fb3dfea195547f0b6b9c5128250f204c6ba7b432c0884ce24f38d9b29b6605fdcf99fdf529e5442b6cc775ec96e003bfc30649ee
  • SSDEEP 768:cu6RaepTPYzbs8WU+Xaamo2q1IxJaxjwHuPI+zjbrgq3ivuiCJzFLWzBDZUx:cu6YepTPso2Be+3+3bUqSvuiCrWVdUx
  • TLSH
    T151232A003BE8812BF2BE4FB899F26145467AF6637603D54D2CC451CB5623FC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2